T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/prom-query.sh:73
- Finding
- Bearer Token May Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `scripts/prom-query.sh`, lines 73–80 and 119–126 **Vulnerability Type**: Authenticated plaintext network communication **Risk Level**: Medium ### Vulnerable Code ```bash # Validate scheme case "$PROMETHEUS_URL" in http://*|https://*) ;; *) die "PROMETHEUS_URL must start with http:// or https:// (got: ${PROMETHEUS_URL})" ;; esac ``` ```bash if [[ -n "${PROMETHEUS_TOKEN:-}" ]]; then final_args+=(-H "Authorization: Bearer ${PROMETHEUS_TOKEN}") fi final_args+=("$@") final_args+=("$url") if ! response=$(curl "${final_args[@]}" 2>"$tmp"); then ``` ### Technical Analysis The URL validation accepts both HTTPS and plaintext HTTP. Independently, the request builder adds `PROMETHEUS_TOKEN` as an HTTP `Authorization: Bearer` header whenever the environment variable is set. There is no check preventing a bearer token from being sent to an `http://` endpoint. When HTTP is used, neither the authorization header nor the Prometheus response has transport confidentiality or integrity. An attacker capable of observing or modifying traffic between the host and the configured server can capture the token, inspect sensitive monitoring information, or tamper with responses supplied to the agent. The token is also included in curl's argument array. On systems where process arguments are visible to other local users or monitoring software, this may create an additional short-lived disclosure surface. The network request itself is necessary for the Skill's declared functionality. However, allowing authenticated requests over plaintext HTTP is not necessary and falls short of least-privilege credential handling. The static pre-scan reference in `CHANGELOG.md` is only documentation of bearer-token support; that file does not transmit data. The actual transmission occurs in this script. ### Attack Path 1. An operator sets `PROMETHEUS_URL` to an `http://` Prometheus-compatible endpoint. 2. The operator also supplies ...[truncated 1326 chars]
- Remediation
- ## Remediation Suggestions 1. Require HTTPS whenever `PROMETHEUS_TOKEN` is set: ```bash if [[ -n "${PROMETHEUS_TOKEN:-}" && "$PROMETHEUS_URL" != https://* ]]; then die "HTTPS is required when PROMETHEUS_TOKEN is configured." fi ``` 2. If local plaintext access is operationally necessary, restrict it to explicit loopback addresses or require a clearly named opt-in such as `PROMETHEUS_ALLOW_INSECURE_HTTP=1`. Emit a prominent warning when this override is used. 3. Prefer secure local proxies or Unix-domain sockets rather than plaintext HTTP for local deployments. 4. Reduce local token exposure by avoiding sensitive headers in command-line arguments where practical. For example, provide curl configuration through a permission-restricted temporary file or another protected input mechanism, and ensure cleanup occurs on all exit paths. 5. Keep standard TLS certificate verification enabled. Do not add `--insecure`; document how operators should install the appropriate private certificate authority instead. 6. Add automated tests confirming that: - HTTP without a token behaves according to the documented policy. - HTTP with a token is rejected by default. - HTTPS with a token is accepted. - Any insecure override is explicit and produces a warning.