T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/kimai_cli.py:25- Finding
Bearer Token Exposure Through Unvalidated Transport and Cross-Origin Redirects
- Content
View full analysis
Any: """Make HTTP request to Kimai API""" url = f"{self.base_url}/api/{endpoint}" if params: query = '&'.join(f"{k}={v}" for k, v in params.items() if v is not None) if query: url += f"?{query}" try: req = urllib.request.Request( url, data=json.dumps(data).encode() if data else None, headers=self.headers, method=method ) with urllib.request.urlopen(req) as response: ``` The related configuration is documented at `SKILL.md`, lines 29–33: ```markdown **Required Environment Variables:** - `KIMAI_BASE_URL` - Full URL to Kimai instance (e.g., `https://kimai.example.com`) - `KIMAI_API_TOKEN` - Bearer token for authentication ``` ### Technical Analysis The client obtains `KIMAI_BASE_URL` from the environment and uses it directly without validating its URL scheme or destination. Every API request includes the Kimai token in the `Authorization` header. Although the documentation gives an HTTPS example, the implementation does not require HTTPS. If the configured URL uses `http://`, the bearer token, timesheet details, customer information, and other request data are transmitted without transport encryption. An attacker a ...[truncated 2933 chars]- Remediation
View remediation