T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search.py:7
- Finding
- Plaintext HTTP Exposes Search Queries and Streamed Responses to Network Interception## Vulnerability Details **File Location**: `scripts/search.py`, lines 7–17 **Vulnerability Type**: Cleartext transmission of potentially sensitive data **Risk Level**: Medium ### Vulnerable Code ```python def baidu_search(query:str) -> Generator[str, None, None]: url = "http://10.222.21.157:6600/api/Agent/queryanswerstream" headers = { "accept": "application/json", "Content-Type": "application/json-patch+json" } data = { "Query": query, "IsReasoner": False } try: response = requests.post(url, json=data, headers=headers, stream=True) ``` ### Technical Analysis The script sends the user-supplied query to a hardcoded private-network endpoint over plaintext HTTP. HTTP provides neither transport confidentiality nor cryptographic server authentication. Any party able to observe or manipulate traffic between the host and `10.222.21.157:6600` may read the submitted query, modify the request, impersonate the service, or alter the streamed response. Although the documented use case concerns financial-report searches, users may include confidential company names, investment research, internal financial questions, or other sensitive context in a query. The service response is also delivered without transport integrity protection and is printed directly to the terminal. ### Attack Path 1. An attacker gains a network-adjacent position, such as access to the same local network, a compromised router or proxy, or control of a relevant network path. 2. A user invokes the skill with a query. 3. The script submits the query in an unencrypted HTTP request to the hardcoded endpoint. 4. The attacker captures the request and reads its JSON `Query` value. 5. The attacker may additionally redirect, impersonate, or modify the HTTP exchange and inject attacker-controlled text into the streamed response. 6. The script prints the manipulated response as though it ca ...[truncated 530 chars]
- Remediation
- ## Remediation Suggestions - Replace the plaintext endpoint with an authenticated HTTPS endpoint, for example `https://.../api/Agent/queryanswerstream`. - Configure the server with a certificate issued by a trusted internal or public certificate authority, and retain TLS certificate verification in `requests`. - Do not disable certificate validation through `verify=False`. If an internal certificate authority is required, provide its CA bundle explicitly. - Consider mutual TLS or authenticated request signing when the endpoint is restricted to trusted internal clients. - Move the endpoint into validated configuration rather than embedding a fixed address in source code. Permit only approved HTTPS origins. - Apply network access controls so only authorized clients can reach the service. - Avoid placing secrets or unnecessary confidential context in queries, and document what data is transmitted to the remote service. - Add explicit connection and read timeouts while updating the request, such as a bounded `timeout` configuration, to prevent indefinite hangs.