T09 · Insecure Skill Coding Practices
Error
- Location
scripts/npm_client.py:10- Finding
Administrative credentials may be transmitted over plaintext HTTP
- Content
View full analysis
time.time() + 3600: return data["token"] # Login to get new token url = f"{NPM_URL}/api/tokens" payload = {"identity": NPM_EMAIL, "secret": NPM_PASSWORD} req = urllib.request.Request(url, data=json.dumps(payload).encode(), headers={"Content-Type": "application/json"}) try: with urllib.request.urlopen(req) as res: ``` The same unrestricted base URL is subsequently used to transmit bearer tokens: ```python def api_call(endpoint, method="GET", payload=None): token = get_token() url = f"{NPM_URL}/api/{endpoint}" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } ``` ### Technical Analysis The client accepts `NPM_URL` directly from the environment without validating its scheme or requiring HTTPS. It sends the Nginx Proxy Manager administrator email and password to `${NPM_URL}/api/tokens`. It also sends the resulting bearer token in the `Authorization` header on later API requests. The documentation provides an HTTPS example, but the implementation still permits an operator to configure an `http://` URL. When HTTP is used, neither the credentials nor bearer token receive transport confidentiality or integrity protection. A network-positioned attacker can observe or modi ...[truncated 1611 chars]- Remediation
View remediation