T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.go:163
- Finding
- SMTP TLS Certificate Verification Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.go:163-169` **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```go // TLS配置 tlsConfig := &tls.Config{ InsecureSkipVerify: true, ServerName: smtpHost, } // 创建TLS连接 conn, err := tls.Dial("tcp", smtpHost+":"+smtpPort, tlsConfig) ``` ### Technical Analysis The SMTP client explicitly sets `InsecureSkipVerify` to `true`. This disables verification of the server certificate and hostname trust chain. Although `ServerName` is configured, Go does not perform normal certificate validation when `InsecureSkipVerify` is enabled. The application authenticates to the resulting SMTP connection using the address and authorization code read from `EMAIL163_ADDRESS` and `EMAIL163_PASSWORD`. An attacker able to intercept or redirect the network connection can present an arbitrary certificate, impersonate the SMTP server, and operate a fake SMTP endpoint. Because the connection is encrypted but not authenticated, encryption alone does not prevent this attack. ### Attack Path 1. A user runs the tool with valid 163 Mail credentials in the required environment variables. 2. A network-positioned attacker intercepts or redirects the connection to `smtp.163.com:465`, such as through a compromised network gateway, DNS manipulation, or local network attack. 3. The attacker presents an arbitrary TLS certificate. 4. The application accepts the certificate because certificate verification is disabled. 5. The attacker's SMTP service completes enough of the SMTP protocol to request authentication. 6. The client sends the configured mailbox address and authorization code to the impersonated server. 7. The attacker can capture the credentials and email contents and may subsequently use the compromised account to send unauthorized messages. ### Impact Assessment Successful exploitation can disclose the sender's mailbox address, SMTP authorization code, recipien ...[truncated 293 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Remove `InsecureSkipVerify` and use Go's standard certificate and hostname verification: ```go tlsConfig := &tls.Config{ ServerName: smtpHost, MinVersion: tls.VersionTLS12, } ``` Additional hardening should include: 1. Use the operating system's trusted certificate store or an explicitly managed trust store. 2. Require TLS 1.2 or newer through `MinVersion`. 3. Fail closed if certificate validation or hostname verification fails. 4. Do not implement fallback behavior that retries with certificate verification disabled. 5. Rotate the SMTP authorization code after deploying the fix if the vulnerable version was used on an untrusted network. ]]>