T09 · Insecure Skill Coding Practices
Error
- Location
- index.ts:388
- Finding
- Unauthenticated Sender IDs Allow Trusted-Peer Impersonation<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:388-429` **Vulnerability Type**: Authentication bypass through spoofable identity and unsafe trust migration **Risk Level**: High ### Vulnerable Code ```typescript function isTrustedPeer(peerId: string): boolean { if (trustedPeers.has(peerId)) return true; // Hostname-prefix matching: if peerId is "raspberrypi-NEWHEX" and we have // "raspberrypi-OLDHEX" trusted, match on the hostname portion and auto-migrate const dashIdx = peerId.lastIndexOf("-"); if (dashIdx === -1) return false; const peerHostname = peerId.slice(0, dashIdx); for (const [trustedId, info] of trustedPeers) { const trustedDash = trustedId.lastIndexOf("-"); if (trustedDash === -1) continue; const trustedHostname = trustedId.slice(0, trustedDash); if (peerHostname === trustedHostname) { // Migrate trust to new ID trustedPeers.set(peerId, { ...info, approvedAt: info.approvedAt }); trustedPeers.delete(trustedId); // Migrate exchange history too const oldHistory = exchangeHistory.get(trustedId); if (oldHistory) { const existing = exchangeHistory.get(peerId) || []; exchangeHistory.set(peerId, [...existing, ...oldHistory]); exchangeHistory.delete(trustedId); } addLog({ direction: "system", peerId, peerAddress: info.ip ? `${info.ip}:${info.port}` : "unknown", message: `Trust migrated from old ID "${trustedId}" → "${peerId}" (same hostname: ${peerHostname})`, trusted: true, }); saveTrust(); return true; } } return false; } ``` The UDP receiver obtains the claimed identity directly from an unauthenticated packet: ```typescript const peerId = msg.sender_id; const peerAddr = `${rinfo.address}:${msg.sender_port || rinfo.port}`; ``` ### Technical Analysis UDP packets carry no authenticated association between `sender_id`, the source address, and the previously approved pe ...[truncated 2075 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace caller-supplied IDs with cryptographically authenticated peer identities: - Give each installation a public/private key pair. - Sign every packet, including the message type, payload, timestamp, port, and a nonce. - Associate approved peers with public keys rather than hostnames. 2. Remove automatic trust migration based only on hostname text. 3. Require explicit user approval whenever a peer key or ID changes. 4. Do not update a trusted peer's stored IP or port until the peer has authenticated the change. 5. Add replay protection using nonces and bounded timestamps. 6. If cryptographic authentication cannot be implemented immediately, require both an exact ID match and the previously approved source IP, while documenting that this is only a temporary defense. 7. Treat existing persisted trust records as potentially unsafe and require re-approval after deploying the corrected identity scheme. ]]>