T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/domain.py:44
- Finding
- Invalid TLS Certificates Are Incorrectly Reported as Valid<![CDATA[ ## Vulnerability Details **File Location**: `scripts/domain.py`, lines 44–48 **Vulnerability Type**: Incorrect TLS certificate verification **Risk Level**: Medium ```python # 提取证书信息 output = result.stdout if "Verify return code" in output: return {"status": "valid", "info": "证书有效"} ``` ### Technical Analysis The implementation considers a certificate valid whenever the OpenSSL output contains the text `Verify return code`. OpenSSL emits this line for both successful and failed certificate verification. A nonzero result, such as an expired, self-signed, or untrusted certificate, can therefore be returned as `valid`. The command also does not use `-verify_return_error` or explicitly verify the requested hostname. The subprocess return code and the exact numeric OpenSSL verification result are ignored. As a result, the status does not reliably establish certificate trust, hostname identity, or expiration validity. ### Attack Path 1. A monitored domain presents an expired, self-signed, untrusted, or otherwise invalid certificate. This could result from server misconfiguration or from an attacker controlling the endpoint or relevant network resolution. 2. The Skill invokes `openssl s_client` against the domain. 3. OpenSSL produces a `Verify return code` line containing a nonzero error code. 4. The code checks only whether that line exists, not whether its value is `0 (ok)`. 5. The Skill returns and displays the certificate status as `valid`. 6. The user may rely on the false result and fail to investigate or remediate the invalid certificate. ### Impact Assessment The vulnerability compromises the integrity and reliability of the certificate-monitoring feature. It can conceal certificate expiration, an untrusted certificate chain, or other verification failures and may cause users to treat an insecure or misconfigured TLS endpoint as healthy. The issue does not directly grant local privileges, execute attacker- ...[truncated 183 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require the exact successful verification result, accepting only verification code `0`. - Run `openssl s_client` with `-verify_return_error` so certificate-chain failures produce an explicit failure. - Add hostname verification, such as `-verify_hostname <domain>`, rather than relying only on SNI through `-servername`. - Check the subprocess return code and treat timeouts, malformed output, and nonzero exits as errors rather than valid certificates. - Parse certificate expiration dates independently when expiration monitoring is required. - Prefer Python's `ssl` module with a default trust context and hostname checking enabled, which avoids fragile parsing of human-readable command output. - Add automated tests covering valid, expired, self-signed, hostname-mismatched, and untrusted-chain certificates. ]]>