T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/serve.py:13
- Finding
- Development HTTP Server Listens on All Network Interfaces with Permissive CORS<![CDATA[ ## Vulnerability Details **File Location**: `scripts/serve.py:13-20,35` **Vulnerability Type**: Externally exposed development server and overly permissive cross-origin access **Risk Level**: Medium ### Vulnerable Code ```python PORT = 8888 DIRECTORY = os.path.dirname(os.path.abspath(__file__)) class MyHTTPRequestHandler(http.server.SimpleHTTPRequestHandler): def __init__(self, *args, **kwargs): super().__init__(*args, directory=DIRECTORY, **kwargs) def end_headers(self): # Add CORS headers for local development self.send_header('Access-Control-Allow-Origin', '*') super().end_headers() ``` ```python with socketserver.TCPServer(("", PORT), MyHTTPRequestHandler) as httpd: print(f"Server started") httpd.serve_forever() ``` ### Technical Analysis Passing an empty host string to `TCPServer` causes the server to listen on all available network interfaces rather than only the loopback interface. This conflicts with the documented local-only address, `http://localhost:8888`. The server also returns `Access-Control-Allow-Origin: *` for every response. Consequently, any website visited by the user may issue browser requests to the service and read the responses. No authentication, origin validation, or access-control mechanism protects the server. The configured document root is the `scripts` directory. The currently reviewed directory contains Python source files rather than credentials; however, every file subsequently placed under this directory and readable by the process would also become remotely retrievable. ### Attack Path 1. A user starts the application using `python3 scripts/serve.py`. 2. The server binds to port 8888 on every available interface. 3. An attacker on a network that can reach the host connects to `<victim-address>:8888`. 4. The attacker enumerates and downloads files exposed by `SimpleHTTPRequestHandler`. 5. Alternatively, an attacker causes the user to visit a malicious webpag ...[truncated 707 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind the server explicitly to the loopback interface: ```python HOST = "127.0.0.1" with socketserver.TCPServer((HOST, PORT), MyHTTPRequestHandler) as httpd: httpd.serve_forever() ``` 2. Remove the wildcard CORS header unless cross-origin access is necessary. 3. If CORS is required, validate the `Origin` header against a narrow allowlist rather than returning `*`. 4. Serve a dedicated static-assets directory containing only files intended for browser access. 5. Do not place secrets, configuration files, logs, or executable administration scripts beneath the web root. 6. Consider adding explicit host-header validation and a minimal security-header policy. 7. Update the startup message to display the actual bound interface. ]]>