T09 · Insecure Skill Coding Practices
- Location
scripts/flowise.py:28- Finding
Bearer credentials and sensitive request data can be transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/flowise.py:28-38
Supporting Documentation Location:SKILL.md:14-15,SKILL.md:35-39
Vulnerability Type: Transmission of sensitive information over an unencrypted channel
Risk Level: HighVulnerable Code:
python def make_request(url: str, method: str = "GET", data: dict = None, api_key: str = None) -> dict: """Make HTTP request to Flowise API""" headers = {"Content-Type": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" body = json.dumps(data).encode() if data else None req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=60) as resp:Relevant documented configuration:
markdown ### Flowise - Server: http://localhost:3000 - API Key: your-api-key-herebash curl -X POST "${FLOWISE_URL}/api/v1/prediction/${FLOW_ID}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{"question": "Hello, how are you?"}'Technical Analysis
The client accepts an unrestricted user-supplied server URL and adds the Flowise API key to the
Authorizationheader. It does not validate the URL scheme or prevent bearer credentials from being sent to a non-loopback endpoint over plaintext HTTP.Plaintext HTTP does not provide transport confidentiality, integrity, or server authentication. If a remote Flowise deployment is configured with an
http://URL, an on-path party may observe the bearer credential, user questions, session identifiers, and server responses. An active network attacker may also modify requests or responses.HTTP access to a service bound exclusively to a trusted loopback interface can be a reasonable deployment choice. The vulnerability arises because the implementation does not restrict plaintext HTTP to loopb ...[truncated 1382 chars]
- Remediation
View remediation
Remediation Suggestions
- Require
https://for all non-loopback Flowise endpoints. - Reject remote plaintext HTTP URLs before constructing or sending a request.
- If local HTTP support is required, limit it to verified loopback hosts such as
localhost,127.0.0.1, and::1; document this as a local-development exception. - Do not silently downgrade from HTTPS to HTTP, and review redirect behavior so credentials cannot be forwarded to an untrusted origin.
- Preserve normal TLS certificate and hostname validation. Do not add an unverified SSL context as a workaround for private certificates.
- Recommend a trusted private certificate authority or reverse proxy with TLS for internal and remote deployments.
- Warn users before sending prompts, files, session identifiers, or credentials to a newly configured external host.
- Update all examples involving authenticated remote access to use HTTPS.
- Require