T09 · Insecure Skill Coding Practices
Error
- Location
- src/__init__.py:8
- Finding
- API Credentials Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `src/__init__.py`, lines 8 and 28–35 **Vulnerability Type**: Plaintext transmission of sensitive credentials **Risk Level**: High ### Vulnerable Code ```python API_URL = "http://projects-databus.gsdata.cn:7777/api-project/service" ``` ```python payload = { "project_id": project_id, "sign": sign, "router": ROUTER, "params": params_json, } resp = requests.post(API_URL, data=payload, timeout=30) ``` ### Technical Analysis The client submits the sensitive `sign` credential, the associated `project_id`, search terms, and other request parameters to an endpoint using unencrypted HTTP. HTTP does not provide transport confidentiality, server authentication, or message integrity. An attacker with visibility or control over the network path can read the request, capture the API credentials, alter request parameters, impersonate the remote API, or modify the response before it reaches the client. ### Attack Path 1. A user invokes the skill while connected through a network controlled or monitored by an attacker. 2. The client sends `project_id`, `sign`, and search parameters to the API over plaintext HTTP. 3. The attacker captures the request and extracts the credentials. 4. The attacker reuses the captured credentials to perform API operations permitted by that signature. 5. Alternatively, the attacker intercepts the response and injects misleading search-result fields that the client accepts and returns without transport-level integrity protection. ### Impact Assessment A successful attacker can obtain the API signature and any search data transmitted through the connection. The attacker may perform unauthorized API requests within the permissions and lifetime of the stolen credential. The attacker may also manipulate search requests or results. This issue does not directly grant privileges on the local host; its scope is limited to the compromised API credentials, API authorization scope, ...[truncated 45 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace the HTTP endpoint with an authenticated HTTPS endpoint. - Reject endpoint configuration that uses any scheme other than `https://`. - Keep TLS certificate verification enabled and do not introduce `verify=False`. - If the service is only available over HTTP, place it behind a properly configured TLS reverse proxy before using it for credentials. - Rotate all API signatures that may previously have been transmitted through this implementation. - Consider using short-lived, narrowly scoped credentials to reduce the impact of future disclosure. - Handle certificate and connection failures securely rather than falling back to plaintext HTTP. ]]>