T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/kimai_cli.py:25
- Finding
- Bearer Token Exposure Through Unvalidated Transport and Cross-Origin Redirects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/kimai_cli.py`, lines 25–47 **Vulnerability Type**: Bearer credential exposure through insecure transport and unrestricted redirects **Risk Level**: Medium ### Vulnerable Code ```python class KimaiClient: def __init__(self, base_url: str, token: str): self.base_url = base_url.rstrip('/') self.token = token self.headers = { 'Authorization': f'Bearer {token}', 'Content-Type': 'application/json', 'Accept': 'application/json' } def _request(self, method: str, endpoint: str, data: Optional[Dict] = None, params: Optional[Dict] = None) -> Any: """Make HTTP request to Kimai API""" url = f"{self.base_url}/api/{endpoint}" if params: query = '&'.join(f"{k}={v}" for k, v in params.items() if v is not None) if query: url += f"?{query}" try: req = urllib.request.Request( url, data=json.dumps(data).encode() if data else None, headers=self.headers, method=method ) with urllib.request.urlopen(req) as response: ``` The related configuration is documented at `SKILL.md`, lines 29–33: ```markdown **Required Environment Variables:** - `KIMAI_BASE_URL` - Full URL to Kimai instance (e.g., `https://kimai.example.com`) - `KIMAI_API_TOKEN` - Bearer token for authentication ``` ### Technical Analysis The client obtains `KIMAI_BASE_URL` from the environment and uses it directly without validating its URL scheme or destination. Every API request includes the Kimai token in the `Authorization` header. Although the documentation gives an HTTPS example, the implementation does not require HTTPS. If the configured URL uses `http://`, the bearer token, timesheet details, customer information, and other request data are transmitted without transport encryption. An attacker a ...[truncated 2933 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require HTTPS by default** - Parse `KIMAI_BASE_URL` with `urllib.parse.urlparse()`. - Reject every scheme other than `https`. - If local HTTP development is necessary, require an explicit opt-in flag and restrict it to loopback destinations such as `localhost`, `127.0.0.1`, or `::1`. 2. **Enforce a redirect origin boundary** - Disable redirects for authenticated API requests, or implement a custom `HTTPRedirectHandler`. - Reject redirects that change the scheme, hostname, or effective port. - Never forward `Authorization` to a different origin. - Reject HTTPS-to-HTTP downgrade redirects in all cases. 3. **Validate endpoint configuration** - Reject URLs containing embedded credentials. - Require a valid hostname and disallow ambiguous or unsupported URL forms. - Consider an explicit hostname allowlist for managed deployments. 4. **Limit credential exposure** - Use a dedicated Kimai API token with only the permissions needed for the requested operations. - Avoid using an administrator token for ordinary time-tracking commands. - Separate read-only, write, and administrative workflows when practical. 5. **Harden request behavior** - Add finite connection and read timeouts to avoid indefinitely blocked operations. - Return generic network errors where possible and avoid exposing sensitive server response content. - Document certificate verification requirements and do not add options that disable TLS verification. 6. **Update the Skill documentation** - State that HTTPS is mandatory except for explicitly enabled loopback development. - Warn users that `KIMAI_BASE_URL` controls where the token and Kimai records are transmitted. - Recommend token rotation immediately after suspected endpoint or network compromise. ]]>