T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/openreview_scraper.py:92
- Finding
- OpenReview credentials can be redirected to an attacker-controlled endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openreview_scraper.py:92-106` **Vulnerability Type**: Unrestricted authentication endpoint **Risk Level**: High ### Vulnerable Code ```python def __init__(self, username: str, password: str, baseurl: str = 'https://api2.openreview.net'): """ 初始化爬虫 Args: username: OpenReview 注册邮箱 password: OpenReview 密码 baseurl: API 地址 (必须用 api2.openreview.net) """ print("正在登录 OpenReview...") try: self.client = openreview.api.OpenReviewClient( baseurl=baseurl, username=username, password=password ) ``` ### Technical Analysis The constructor accepts a caller-controlled `baseurl` and passes it to `OpenReviewClient` together with the user's OpenReview username and password. Although the default value and documentation identify `https://api2.openreview.net` as the required endpoint, the implementation does not enforce that restriction. There is no validation of the URL scheme, hostname, port, user-information component, or redirect behavior. Consequently, a malicious caller can substitute an endpoint under their control and cause authentication information to be submitted to it. Reading credentials from environment variables does not mitigate this issue because those credentials are subsequently supplied to the unrestricted endpoint. The network transmission is legitimate only when directed to the official OpenReview API. Permitting arbitrary destinations exceeds the minimum network privileges required by the declared conference-scraping functionality. ### Attack Path 1. A user or agent places valid OpenReview credentials in `OPENREVIEW_USER` and `OPENREVIEW_PASSWORD`. 2. An attacker influences a task, wrapper, copied example, or direct constructor invocation. 3. The attacker supplies a value such as `https://attacker.example/api` as `baseurl`. 4. `OpenReviewScraper` passes the credentials and attacker-controlled ...[truncated 688 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the public `baseurl` parameter if alternate OpenReview endpoints are not required. - Otherwise, parse the URL and enforce: - HTTPS only. - Exact hostname `api2.openreview.net`. - No embedded username or password. - No unexpected port. - No redirects to a different hostname. - Reject malformed, IP-literal, loopback, private, link-local, and reserved destinations. - Prefer revocable API tokens over reusable account passwords if supported. - Avoid keeping the plaintext password longer than required to initialize the client. - Add tests proving that attacker-controlled hosts, HTTP endpoints, deceptive subdomains, and cross-host redirects are rejected. ]]>