T09 · Insecure Skill Coding Practices
Warning
- Location
- references/setup-guide.md:49
- Finding
- Broker Credentials and Administrative Traffic May Be Transmitted Without TLS## Vulnerability Details **File Location**: `references/setup-guide.md:49-66` **Vulnerability Type**: Plaintext transmission of credentials and sensitive operational data **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml targets: - name: cache1 platform: redis host: 10.0.0.10 port: 6379 username: "" db: 0 use_tls: false verify_ssl: true - name: broker1 platform: rabbitmq host: 10.0.0.20 port: 15672 username: queueops db: 0 use_tls: false verify_ssl: true ``` The capability reference also documents Redis authentication over RESP and RabbitMQ HTTP Basic authentication, while TLS remains optional. ### Technical Analysis The example configuration disables TLS for both supported platforms. With Redis, authentication material and commands may consequently be sent over an unencrypted RESP connection. With RabbitMQ, port 15672 normally provides HTTP, so HTTP Basic credentials and management API requests may travel without transport encryption. Setting `verify_ssl: true` does not provide protection when `use_tls` is false because there is no TLS certificate to verify. Sensitive data handled by the Skill includes broker passwords, Redis slow-log commands, client addresses, configuration values, queue metadata, and administrative commands. Connecting to configured brokers is necessary for the declared functionality and no unrelated exfiltration destination was identified. The security issue is that the documented defaults do not protect that necessary network traffic. ### Attack Path 1. An operator follows the documented example and configures a remote broker with `use_tls: false`. 2. The Skill authenticates to Redis or RabbitMQ across a network accessible to an attacker. 3. An attacker with an on-path position, compromised network device, or access to the same insecure network captures or modifies the plaintext traffic. 4. The att ...[truncated 730 chars]
- Remediation
- ## Remediation Suggestions - Enable TLS by default for both Redis and RabbitMQ targets. - Use the appropriate TLS endpoints and ports, such as RabbitMQ port 15671 where configured. - Require certificate verification by default and reject invalid or untrusted certificates. - Restrict `use_tls: false` and disabled certificate verification to an explicit local-lab mode. - Display a prominent warning or refuse authentication when credentials would be sent over plaintext transport. - Document secure certificate deployment, private certificate-authority configuration, and certificate rotation procedures. - Use read-only, least-privilege broker accounts even when TLS is enabled.