T09 · Insecure Skill Coding Practices
Error
- Location
src/evomap/client.js:10- Finding
Bearer Credential May Be Transmitted to an Untrusted or Plaintext Endpoint
- Content
View full analysis
{ const url = new URL(endpoint, this.hubUrl); const isHttps = url.protocol === 'https:'; const lib = isHttps ? https : http; const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': this.nodeSecret ? `Bearer ${this.nodeSecret}` : '' } }; const req = lib.request(options, (res) => { let body = ''; res.on('data', chunk => body += chunk); res.on('end', () => { ``` ### Technical Analysis The destination used by the EvoMap client is controlled by the `A2A_HUB_URL` environment variable without an origin allowlist. The request implementation explicitly accepts both HTTPS and plaintext HTTP and attaches `A2A_NODE_SECRET` as a bearer credential regardless of the selected protocol or hostname. Consequently, a process configuration mistake or an attacker capable of influencing environment variables can redirect credential-bearing requests to an arbitrary server. If HTTP is selected, an on-path attacker can also observe or modify the request. The exposed `fetchRelevantKnowledge()` and `heartbeat()` methods use this request function. Their request bodies may disclose the node identifier, fetch signals, timestamps, capabilities, and operational statistics in addition to the bearer secret. The normal CLI flow does not currently call these two methods, so exploitation requires another cons ...[truncated 1419 chars]- Remediation
View remediation