T09 · Insecure Skill Coding Practices
Error
- Location
bin/wiki2doc.py:308- Finding
Credentials Submitted to an Attacker-Controlled Login Page
- Content
View full analysis
{ const form = document.querySelector('form[name="loginform"]'); if (form) { form.submit(); } }''') # Wait for login to complete and redirect to target page page.wait_for_load_state("networkidle", timeout=15000) ``` ### Technical Analysis The target URL is supplied by the user and passed directly to `page.goto`. The code does not verify that the initial URL or its redirect destination belongs to the configured Confluence origin. Authentication is triggered merely when the resulting URL contains the substring `login` or `login.action`. An attacker can host a page at a URL such as `https://attacker.example/login` with input elements named `os_username` and `os_password` and a form named `loginform`. The program will then populate and submit the embedded Confluence credentials to the attacker. Substring matching is not a secure origin-verification mechanism. The scheme, hostname, port, resolved IP address, and redirect chain must all be validated before credentials are entered. ### Attack Path 1. An attacker prepares a page at `https://attacker.example/login`. 2. The page contains inputs named `os_username` and `os_password` an ...[truncated 769 chars]- Remediation
View remediation