T09 · Insecure Skill Coding Practices
Error
- Location
- bambu.py:31
- Finding
- MQTT TLS Certificate Verification Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `bambu.py:31-32` **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```python def get_client(): client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2) client.username_pw_set("bblp", ACCESS_CODE) client.tls_set(cert_reqs=ssl.CERT_NONE) client.tls_insecure_set(True) return client ``` ### Technical Analysis The MQTT client enables TLS encryption but explicitly disables certificate verification through both `cert_reqs=ssl.CERT_NONE` and `tls_insecure_set(True)`. The application therefore cannot authenticate that the TLS endpoint is the intended Bambu Lab printer. The printer access code is configured as the MQTT password. A network-positioned attacker can impersonate the printer's MQTT service, terminate the unauthenticated TLS connection, and receive the credentials supplied by the client. The attacker can also return forged printer reports or observe commands sent by the user. This is particularly security-sensitive because the supported commands include temperature changes, print interruption, and arbitrary G-code. ### Attack Path 1. An attacker obtains a man-in-the-middle position on the printer's local network, such as through a compromised access point, ARP spoofing, or control of network infrastructure. 2. The attacker redirects traffic intended for the configured printer address to a malicious MQTT TLS endpoint. 3. The endpoint presents an arbitrary certificate. 4. The client accepts that certificate because certificate verification and hostname validation are disabled. 5. The client authenticates with username `bblp` and the configured printer access code, exposing the credential to the malicious endpoint. 6. The attacker uses the captured access code to connect to the actual printer or manipulates the active MQTT session. 7. The attacker may issue printer control commands, alter temperature settings, interrupt prints, inject ...[truncated 728 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both insecure TLS settings: - Do not use `cert_reqs=ssl.CERT_NONE`. - Do not call `tls_insecure_set(True)`. 2. Configure the client to require certificate validation with `ssl.CERT_REQUIRED`. 3. Trust a documented printer CA certificate where the device platform supports it. 4. If the printer uses a self-signed certificate, implement explicit certificate or public-key fingerprint pinning and reject every unexpected certificate. 5. Verify the expected endpoint identity in addition to validating the certificate chain. 6. Fail closed when certificate validation fails; do not silently downgrade to insecure MQTT or unauthenticated TLS. 7. Clearly document any device-specific certificate provisioning or pin-rotation procedure. 8. As defense in depth, place the printer on an isolated trusted VLAN, restrict TCP port 8883 to approved controller hosts, and prevent untrusted clients from joining that network. ]]>