T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/flowise.py:28
- Finding
- Bearer credentials and sensitive request data can be transmitted over plaintext HTTP## Vulnerability Details **File Location**: `scripts/flowise.py:28-38` **Supporting Documentation Location**: `SKILL.md:14-15`, `SKILL.md:35-39` **Vulnerability Type**: Transmission of sensitive information over an unencrypted channel **Risk Level**: High **Vulnerable Code**: ```python def make_request(url: str, method: str = "GET", data: dict = None, api_key: str = None) -> dict: """Make HTTP request to Flowise API""" headers = {"Content-Type": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" body = json.dumps(data).encode() if data else None req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=60) as resp: ``` **Relevant documented configuration**: ```markdown ### Flowise - Server: http://localhost:3000 - API Key: your-api-key-here ``` ```bash curl -X POST "${FLOWISE_URL}/api/v1/prediction/${FLOW_ID}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{"question": "Hello, how are you?"}' ``` ### Technical Analysis The client accepts an unrestricted user-supplied server URL and adds the Flowise API key to the `Authorization` header. It does not validate the URL scheme or prevent bearer credentials from being sent to a non-loopback endpoint over plaintext HTTP. Plaintext HTTP does not provide transport confidentiality, integrity, or server authentication. If a remote Flowise deployment is configured with an `http://` URL, an on-path party may observe the bearer credential, user questions, session identifiers, and server responses. An active network attacker may also modify requests or responses. HTTP access to a service bound exclusively to a trusted loopback interface can be a reasonable deployment choice. The vulnerability arises because the implementation does not restrict plaintext HTTP to loopb ...[truncated 1382 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https://` for all non-loopback Flowise endpoints. 2. Reject remote plaintext HTTP URLs before constructing or sending a request. 3. If local HTTP support is required, limit it to verified loopback hosts such as `localhost`, `127.0.0.1`, and `::1`; document this as a local-development exception. 4. Do not silently downgrade from HTTPS to HTTP, and review redirect behavior so credentials cannot be forwarded to an untrusted origin. 5. Preserve normal TLS certificate and hostname validation. Do not add an unverified SSL context as a workaround for private certificates. 6. Recommend a trusted private certificate authority or reverse proxy with TLS for internal and remote deployments. 7. Warn users before sending prompts, files, session identifiers, or credentials to a newly configured external host. 8. Update all examples involving authenticated remote access to use HTTPS.