T09 · Insecure Skill Coding Practices
Warning
- Location
- hub_client.py:53
- Finding
- API Credentials and Message Data Can Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `hub_client.py:53, 62-66, 71-74`; identical code in `message_hub.py:53, 62-66, 71-74` **Vulnerability Type**: Cleartext transmission of sensitive information **Risk Level**: Medium ### Vulnerable Code ```python self.base_url = base_url or os.getenv("MESSAGE_HUB_URL", "http://localhost:8000") self.api_key = api_key or os.getenv("MESSAGE_HUB_API_KEY") self.sender = sender or os.getenv("MESSAGE_HUB_SENDER", "Unknown") self.retry_times = retry_times self.retry_delay = retry_delay if not self.api_key: raise ValueError("API Key must be configured") self.session = requests.Session() self.session.headers.update({ "Content-Type": "application/json", "X-API-Key": self.api_key }) ``` ```python def _request(self, method: str, endpoint: str, data: Optional[Dict] = None) -> Dict: """Send an HTTP request with retries.""" url = f"{self.base_url}{endpoint}" for attempt in range(self.retry_times): try: response = self.session.request(method, url, json=data, timeout=30) response.raise_for_status() return response.json() except requests.exceptions.RequestException as e: if attempt == self.retry_times - 1: raise RetryError(f"Request failed after {self.retry_times} attempts: {e}") time.sleep(self.retry_delay * (attempt + 1)) ``` The insecure configuration is also promoted in the examples at `README.md:23, 39, 111, 120, 144`. ### Technical Analysis The client accepts arbitrary HTTP endpoints and defaults to an `http://` URL. Every request made through the session includes the `X-API-Key` credential. Push requests also contain message contents, sender identities, recipients, and other potentially sensitive metadata. HTTP provides neither transport confidentiality nor server authentication. Although the default loopback address is less exposed, the ...[truncated 1824 chars]
- Remediation
- ## Remediation Suggestions 1. Require HTTPS for every non-loopback Message Hub endpoint. 2. Parse and validate `base_url` during initialization. Reject `http://` unless the hostname is explicitly verified as a loopback address and insecure development mode has been deliberately enabled. 3. Preserve the default TLS certificate and hostname verification behavior of `requests`; do not introduce `verify=False`. 4. Change documentation and examples to use `https://` for all non-local deployments. 5. Consider requiring an explicit option such as `allow_insecure_localhost=True` for local HTTP development rather than silently permitting plaintext transport. 6. Rotate any API key that may previously have been sent over an untrusted plaintext connection. 7. Use narrowly scoped API keys with expiration, revocation, and per-operation authorization to reduce the impact of credential theft. 8. Consider using mutual TLS or another strong client-authentication mechanism for high-trust deployments.