T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/track17.py:1234
- Finding
- Webhook signatures are detected but not enforced<![CDATA[ ## Vulnerability Details **File Location**: `scripts/track17.py:1234-1310` **Vulnerability Type**: Authentication bypass in webhook ingestion **Risk Level**: High ### Vulnerable Code ```python sig_valid: Optional[bool] = None if secret and sig_value: expected = compute_webhook_signature(raw_body, secret) sig_valid = expected.lower() == sig_value.lower() payload_sha = store_payload( conn, raw_body=raw_body, source=source, event_type=None, number=None, carrier=None, signature=sig_value, signature_valid=sig_valid, ) payload = parse_webhook_payload(raw_body) # 17TRACK webhook structure: { event: "TRACKING_UPDATED", data: {...} } event_type = payload.get("event") data = payload.get("data") # Update payload record with extracted basics (best-effort) number = None carrier = None if isinstance(data, dict): number = data.get("number") carrier = data.get("carrier") conn.execute( "UPDATE payloads SET event_type=?, number=?, carrier=? WHERE sha256=?", (event_type, number, carrier, payload_sha), ) conn.commit() if not isinstance(data, dict): return False, f"Stored payload {payload_sha} (no data object)" number_s = _normalise_number(str(data.get("number") or "")) carrier_i = int(data.get("carrier") or 0) tag = str(data.get("tag") or "") param = str(data.get("param") or "") # Ensure package exists pkg = conn.execute( "SELECT * FROM packages WHERE number=? AND carrier=? AND param=? ORDER BY id DESC LIMIT 1", (number_s, carrier_i, param), ).fetchone() if not pkg: pkg = upsert_package( conn, number=number_s, carrier=carrier_i, param=param, label=None, tag=tag, lang=os.environ.get("TRACK17_LANG") or "en", api_registered=True, ) # Use the data object as the response item; it includes track_info. changed, summary = apply_update_from_trackinfo( conn, package_row=pkg, response_item=data, raw_payload_sha=payloa ...[truncated 2734 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce signature authentication before storing or processing a payload when `TRACK17_WEBHOOK_SECRET` is configured: ```python import hmac if secret: if not sig_value: raise Track17Error("Webhook signature is required") expected = compute_webhook_signature(raw_body, secret) if not hmac.compare_digest(expected.lower(), sig_value.lower()): raise Track17Error("Invalid webhook signature") ``` 2. Perform this check before `store_payload`, package creation, or any database mutation. If retaining rejected payloads for forensic purposes is necessary, store them in a separate quarantine area that is never processed as trusted tracking data. 3. Make the HTTP receiver authenticate synchronously where practical and return `401 Unauthorized` or `403 Forbidden` for missing or invalid signatures instead of always returning `200 OK`. 4. Define and accept only the documented 17TRACK signature header rather than guessing numerous generic header names, unless compatibility requirements are explicitly documented. 5. For manual file or standard-input ingestion, either: - Require a trusted sidecar containing the original signature header; - Add an explicit signature argument; or - Clearly designate the command as a privileged, trusted local-import mechanism and require an explicit bypass flag. 6. Add tests proving that missing and invalid signatures cannot create packages, update statuses, or insert events when a secret is configured. ]]>