T09 · Insecure Skill Coding Practices
Error
- Location
dashboard/server.py:420- Finding
Dashboard Action Token Disclosed to Unauthenticated Page Requesters
- Content
View full analysis
None: if not path.exists(): self.send_error(HTTPStatus.NOT_FOUND) return body = path.read_bytes() if path.name == "index.html": injection = f"" body = body.replace(b"", injection.encode("utf-8") + b"") self.send_response(200) self.send_header("Content-Type", content_type) self.send_header("Cache-Control", "no-store") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) ``` The token protects the following sensitive actions: ```python def verify_action(headers) -> tuple[bool, str]: if not ACTIONS_ENABLED: return False, "Dashboard actions are disabled." token = headers.get("X-Watchdog-Token", "") if not ACTION_TOKEN or not secrets.compare_digest(token, ACTION_TOKEN): return False, "Invalid or missing dashboard action token." return True, "ok" ``` ### Technical Analysis The dashboard's supposedly secret action token is embedded directly into every unauthenticated response for `/` or `/index.html`. Consequently, any client capable of requesting the dashboard page can recover the credential from `window.WATCHDOG_ACTION_TOKEN`. The server does not validate the HTTP `Host` or `Origin` header. Binding to `127.0.0.1` reduces direct remote exposure but does not establish an authentication boundary. Local malware, another process running under the user, a browser extension, or a browser-based DNS-rebinding attack could potentially request the page and obtain the token. Once recovered, the token authorizes Gateway restart, diagnostics exec ...[truncated 1283 chars]- Remediation
View remediation