T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:79- Finding
IMAP TLS Certificate Validation Disabled
- Content
View full analysis
array( 'verify_peer' => false, 'verify_peer_name' => false, ), ); ``` ### Technical Analysis The recommended Roundcube configuration explicitly disables both certificate-chain validation and server hostname verification for the Gmail IMAP connection. Although traffic remains encrypted, the client no longer verifies that it is communicating with the legitimate Gmail server. An attacker able to intercept or redirect network traffic can present an arbitrary TLS certificate. Because neither the certificate issuer nor hostname is verified, Roundcube can establish a connection to the attacker's server without detecting the impersonation. ### Attack Path 1. A user deploys Roundcube using the documented configuration. 2. An attacker obtains a network interception position or manipulates DNS, routing, or a local proxy. 3. The attacker redirects the IMAP connection to an attacker-controlled endpoint. 4. The endpoint presents an untrusted or hostname-mismatched TLS certificate. 5. Roundcube accepts the certificate because both verification controls are disabled. 6. Authentication data and mailbox communications can be intercepted or manipulated. ### Impact Assessment A successful attack can compromise credentials supplied to the IMAP service and expose email messages, attachments, metadata, and other mailbox content. Depending on the intercepted credentials and Gmail account configuration, the attacker may also obtain ongoing mailbox access or impersonate the account owner. ]]>- Remediation
View remediation