T09 · Insecure Skill Coding Practices
Error
- Location
- skills/smyx_common/scripts/config-dev.yaml:1
- Finding
- Authentication Tokens, Internal Identity, and Uploaded Media Are Transmitted Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `skills/smyx_common/scripts/config-dev.yaml:1-7`; `skills/smyx_common/scripts/util.py:545-561, 572-612, 646` **Vulnerability Type**: Cleartext transmission of credentials and sensitive user data **Risk Level**: High ### Vulnerable Code ```yaml ApiEnum: base-url-open-api: "http://192.168.1.234:9601/smyx-open-api" base-url-open-h5: "http://192.168.1.234:4100" base-url-health: "http://192.168.1.234:7070/jeecg-boot-xzgz" ConstantEnum: is-debug: true ``` The development configuration is enabled by the active configuration: ```yaml env: dev ``` The request utility sends the internal identity to the HTTP health endpoint: ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) ``` It subsequently attaches authentication credentials and identity data to analysis requests: ```python if not url.startswith("https://") and not url.startswith("http://"): url = cls.BASE_URL + url headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum.OPEN_TOKEN) if current__user_name: data.setdefault('pnaUserName', current__user_name) response = requests.request( method, url, *args, json=data, params=params, headers=headers, timeout=int(timeout), **argss ) ``` ### Technical Analysis `config.yaml` selects the `dev` environment, causing `config-dev.yaml` to override the otherwise HTTPS production endpoints. All three development endpoints use unencrypted HTTP. The normal execution flow sends the following information over these endpoints: - The internally resolved Open ID in both the `ope ...[truncated 2401 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change every API and report endpoint to HTTPS and remove plaintext HTTP fallbacks. 2. Do not distribute the package with `env: dev`; default to a production configuration containing validated HTTPS endpoints. 3. Reject any request URL whose scheme is not `https`. 4. Implement an explicit hostname allowlist for all authenticated requests. 5. Resolve relative paths against a single trusted base URL and prohibit callers from supplying arbitrary absolute URLs. 6. Attach authentication headers only after confirming that the final normalized URL belongs to an approved origin. 7. Use certificate verification without disabling `requests` verification. Where appropriate, add certificate or public-key pinning. 8. Rotate all tokens that may already have traversed the plaintext development endpoints. 9. Separate development credentials and environments from production identities and data. 10. Add automated tests that fail when an endpoint uses HTTP or when credentials would be sent to an unapproved host. 11. Clearly disclose to users that media is uploaded to a remote service and identify the approved service destination. ]]>