T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/media_gen_client.py:50
- Finding
- TLS Certificate and Hostname Verification Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/media_gen_client.py:50-54` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python try: ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE with urllib.request.urlopen(req, timeout=timeout_s, context=ctx) as resp: ``` ### Technical Analysis The client creates a default TLS context but then explicitly disables hostname verification and certificate-chain validation. Consequently, the HTTPS connection provides encryption without reliable authentication of the remote server. This setting applies to every request made through `_http_request_json`, including video creation and task-status polling. Those requests carry the `MAGIC_API_KEY` in the `Authorization: Bearer` header. Video creation requests also contain the complete user-provided text. Sending the API key and user content to the declared remote generation service is necessary for the Skill's functionality. Disabling TLS verification is not necessary and exceeds acceptable handling risk for those sensitive values. ### Attack Path 1. An attacker obtains a network interception position, such as through a malicious Wi-Fi access point, compromised proxy, DNS manipulation, or routing attack. 2. The attacker redirects or intercepts a request intended for `open-test.magiclight.ai`. 3. The attacker presents an arbitrary or self-signed TLS certificate. 4. Because both certificate verification and hostname checking are disabled, the client accepts the attacker's endpoint. 5. The client transmits the bearer API key and, during task creation, the user's complete text to the attacker. 6. The attacker can return forged task JSON, including a fabricated task ID, status, or attacker-controlled video URL. ### Impact Assessment A successful attacker can obtain the `MAGIC_API_KEY` and any user text submitted for video generation. The stolen key may p ...[truncated 516 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Use Python's default verified TLS behavior and do not override certificate or hostname checks: ```python ctx = ssl.create_default_context() with urllib.request.urlopen(req, timeout=timeout_s, context=ctx) as resp: raw = resp.read().decode("utf-8") ``` Alternatively, omit the custom context entirely and allow `urllib.request.urlopen` to use the platform's trusted certificate store. Additional hardening should include: 1. Never introduce a fallback that retries with certificate verification disabled. 2. Fail closed and return a clear network error when certificate validation fails. 3. If the service uses a private certificate authority, load only that CA through `SSLContext.load_verify_locations()` rather than disabling validation. 4. Consider certificate or public-key pinning only if the service has a reliable certificate-rotation process. 5. Rotate the API credential if the vulnerable client has been used over untrusted networks. 6. Avoid logging authorization headers or full sensitive request bodies while diagnosing TLS failures. ]]>