T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/komodo.py:54
- Finding
- Komodo credentials and deployment secrets can be transmitted to an insecure or untrusted endpoint## Vulnerability Details **File Location**: `scripts/komodo.py:54-70`; additional sensitive-file transmission at `scripts/komodo.py:379-410` **Vulnerability Type**: Unrestricted transmission of authentication credentials and environment secrets **Risk Level**: High ### Vulnerable Code ```python KOMODO_ADDRESS = os.environ.get("KOMODO_ADDRESS", "").rstrip("/") KOMODO_API_KEY = os.environ.get("KOMODO_API_KEY", "") KOMODO_API_SECRET = os.environ.get("KOMODO_API_SECRET", "") def api_call(endpoint: str, payload: dict | None = None, method: str = "POST") -> Any: """Make an API call to Komodo Core.""" if not KOMODO_ADDRESS: print("Error: KOMODO_ADDRESS not set", file=sys.stderr) sys.exit(1) if not KOMODO_API_KEY or not KOMODO_API_SECRET: print("Error: KOMODO_API_KEY or KOMODO_API_SECRET not set", file=sys.stderr) sys.exit(1) url = f"{KOMODO_ADDRESS}/{endpoint}" headers = { "Content-Type": "application/json", "X-Api-Key": KOMODO_API_KEY, "X-Api-Secret": KOMODO_API_SECRET, } data = json.dumps(payload or {}).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=30) as response: return json.loads(response.read().decode("utf-8")) ``` The `create-stack` operation also reads a caller-selected environment file and incorporates every parsed value into the network request: ```python def cmd_create_stack(name: str, server: str, compose_file: str, env_file: str | None = None): """Create a new stack from compose file.""" # Read compose file try: with open(compose_file, "r") as f: compose_contents = f.read() except FileNotFoundError: print(f"Error: Compose file '{compose_file}' not found.") sys.exit(1) # Read env file if provide ...[truncated 4088 chars]
- Remediation
- ## Remediation Suggestions 1. Parse `KOMODO_ADDRESS` with `urllib.parse.urlparse` and reject every scheme except `https`. 2. Require the hostname to match an explicit operator-configured allowlist or a securely stored expected Komodo Core origin. 3. Reject URLs containing unexpected user information, fragments, or malformed host components. 4. Disable automatic redirects for authenticated requests, or only follow redirects after verifying that the scheme, hostname, and port exactly match the original trusted origin. 5. Never forward `X-Api-Key` or `X-Api-Secret` across an origin change. 6. Validate TLS certificates using the system trust store and do not introduce certificate-verification bypasses. 7. Before `create-stack` uploads an environment file, clearly display the destination host and request explicit confirmation. 8. Support an allowlist of environment-variable names so only values required by the stack are transmitted. 9. Prefer secret references managed by Komodo or an external secret manager instead of embedding plaintext secret values in the stack payload. 10. Use a dedicated, least-privileged Komodo API identity and separate read-only credentials from credentials authorized for deployment or deletion. 11. Replace credentials immediately if they may previously have been sent over HTTP or to an untrusted endpoint.