T09 · Insecure Skill Coding Practices
Warning
- Location
ref/api.md:3- Finding
Bearer Authentication Token Transmitted Over Plaintext HTTP
- Content
View full analysis
` ``` The same insecure configuration is presented in `SKILL.md`, where the default gateway URL uses HTTP while authentication uses the `KNX_TOKEN` Bearer credential: ```markdown | Parameter | Default | Description | |-----------|---------|-------------| | Base URL | `http://ycznwl.local/api/v1` | Default mDNS address — use as-is unless the user provides their own gateway address or IP | | Auth | `Authorization: Bearer ${KNX_TOKEN}` | See token instructions below | ``` ### Technical Analysis The Skill directs the agent to authenticate to the KNX gateway by transmitting a reusable Bearer token over unencrypted HTTP. Bearer tokens provide access based solely on possession; therefore, anyone who captures the token can generally reuse it without knowing another secret. A trusted LAN or VPN designation does not independently provide authenticated, end-to-end encryption between the agent and the gateway. On a local network, an attacker with traffic visibility may capture the Authorization header. An attacker capable of DNS or mDNS spoofing, ARP spoofing, malicious access-point operation, proxy manipulation, or gateway impersonation may also redirect or modify requests. The instruction to use the plaintext default address “as-is” increases the likelihood that credential-bearing requests will be issued without first establishing transport authenticity. ### Attack Path 1. The agent resolves `ycznwl.local` and connects to the gateway through the documented `http://` endpoint. 2. The agent sends `Authorization: Bearer ${KNX_TOKEN}` without transport encryption. 3. An attacker on the same networ ...[truncated 1411 chars]- Remediation
View remediation