HTTP runner defaults to verify=False, disabling TLS certificate validation (CWE-295)

Summary

The HTTP runner (http_runner) defaults to verify=False for all outbound HTTP requests, disabling TLS certificate validation. This makes any action using the HTTP runner vulnerable to man-in-the-middle attacks by default.

Affected File

contrib/runners/http_runner/http_runner/http_runner.py (line 203)

def __init__(
    self,
    url=None,
    method=None,
    body="",
    params=None,
    headers=None,
    cookies=None,
    auth=None,
    timeout=60,
    allow_redirects=False,
    proxies=None,
    files=None,
    verify=False,  # <-- TLS verification disabled by default
    username=None,
    password=None,
    url_hosts_blacklist=None,
    url_hosts_whitelist=None,
):

Impact

The HTTP runner is one of the most commonly used runners in StackStorm. Any action using core.http or the HTTP runner will skip TLS certificate validation unless the user explicitly passes verify=true. This means:

• Connections to HTTPS endpoints do not verify the server's certificate chain
• An attacker in a network position to intercept traffic can perform man-in-the-middle attacks
• Credentials, API tokens, and sensitive payloads sent via the HTTP runner can be intercepted

This is particularly concerning in datacenter and infrastructure automation contexts where the HTTP runner is used to interact with management APIs (e.g., cloud providers, network devices, internal services).

Recommended Fix

Change the default to verify=True:

def __init__(self, url=None, method=None, ..., verify=True, ...):

Users who need to disable verification for specific endpoints (e.g., self-signed certs in lab environments) can still pass verify=false explicitly. This follows the principle of secure-by-default.

If backward compatibility is a concern, consider:

1. Adding a deprecation warning when verify=false is used without being explicitly set
2. Adding a configuration option in st2.conf to control the default globally

References

• CWE-295: Improper Certificate Validation
• Discovered via manual code review

Start in contrib/runners/http_runner/http_runner/http_runner.py at the HTTP runner constructor around line 203, and inspect how the verify argument is passed to outbound requests. Confirm the default validates TLS certificates while an explicit verify=false remains available, then run the HTTP runner's existing tests if available.