T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_gzh_trends.py:130- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_gzh_trends.py, lines 130–134
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable Code
python sock = socket.create_connection((host, 443), timeout=timeout) context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) context.check_hostname = False context.verify_mode = ssl.CERT_NONE ssl_sock = context.wrap_socket(sock, server_hostname=None)Technical Analysis
The script establishes an HTTPS connection using a raw socket but explicitly disables both certificate-chain validation and hostname verification. It also omits Server Name Indication by passing
server_hostname=None.Consequently, the TLS channel encrypts traffic but does not authenticate the remote server. Any certificate presented during the handshake is accepted, including a self-signed certificate controlled by an attacker.
The affected connection sends the user's search keyword and optional start date to the fixed API endpoint at
onetotenvip.com. The response is parsed as JSON and used to generate local HTML and JSON reports. Although article URLs are restricted to the HTTP and HTTPS schemes, they are not restricted to trusted hosts. Therefore, forged API data can introduce attacker-controlled HTTP(S) links into generated reports.Attack Path
- A victim runs the trend-fetching script on a network that an attacker can intercept or influence.
- The attacker redirects or intercepts the connection to
onetotenvip.com, such as through a malicious access point, compromised router, DNS manipulation, or another network-positioned attack. - The attacker presents an arbitrary TLS certificate.
- The script accepts the certificate because certificate validation and hostname checking are disabled.
- The attacker receives the submitted query metadata and returns a forged JSON response matching the expected API structure.
- The script processes the forged article records and embeds attacker-c ...[truncated 884 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the custom unverified TLS implementation with a maintained HTTPS client that verifies certificates by default:
python import requests response = requests.get( base_url, params=params, headers=headers, timeout=60, ) response.raise_for_status() data = response.json()- If raw sockets are strictly necessary, use the platform trust store and enable hostname verification:
python sock = socket.create_connection((host, 443), timeout=timeout) context = ssl.create_default_context() ssl_sock = context.wrap_socket(sock, server_hostname=host)- Remove all insecure settings:
python context.check_hostname = False context.verify_mode = ssl.CERT_NONE server_hostname = None-
Fail closed on certificate, hostname, handshake, and response-validation errors. Do not retry through an unverified transport.
-
Validate the API response against an explicit schema before generating reports, including expected types, collection-size limits, and string-length limits.
-
Consider restricting returned article links to expected trusted domains if the service contract permits it. Scheme-only validation prevents
javascript:URLs but does not prevent phishing links on arbitrary HTTP(S) hosts. -
Add automated tests confirming that self-signed, expired, mismatched-hostname, and untrusted certificates are rejected.