T09 · Insecure Skill Coding Practices
Error
- Location
skills/smyx_common/scripts/util.py:568- Finding
Authentication Credentials Can Be Forwarded to Arbitrary Network Destinations
- Content
View full analysis
Vulnerability Details
File Location:
skills/smyx_common/scripts/util.py:568-608, 642
Vulnerability Type: Missing destination validation when attaching authentication credentials
Risk Level: HighVulnerable Code
python if not url.startswith("https://") and not url.startswith("http://"): url = cls.BASE_URL + url headers['App-Id'] = ConstantEnum.APP__ID if not (ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID): OpenIdUtil.resolve_current_open_id(use_current=False) current__user_name = ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = user_dao.get_by_username(current__user_name) if found_user: ApiEnum.TOKEN = found_user.token ApiEnum.OPEN_TOKEN = found_user.open_token current__user_name = found_user.username if not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN: new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken") user_model = User.load(current_user_info) user = user_dao.save( user_model ) except Exception as e: CommonUtil.trace_exception_stack(e) raise headers.setd ...[truncated 2682 chars]- Remediation
View remediation
Remediation Suggestions
- Reject absolute URLs in authenticated request helpers and accept only relative API paths.
- Resolve paths against one fixed HTTPS base URL using a safe URL-joining implementation.
- If absolute URLs are operationally necessary, enforce an exact allowlist of approved schemes, hostnames, and ports after canonical URL parsing.
- Attach authentication headers only when the final normalized destination exactly matches the trusted API origin.
- Reject
http://for every request carrying credentials or sensitive user data. - Disable cross-origin redirects or remove authentication headers whenever a redirect changes origin.
- Separate authenticated first-party requests from generic unauthenticated network requests into distinct APIs.
- Add tests covering attacker-controlled absolute URLs, encoded hostnames, user-info URL syntax, alternate ports, subdomain confusion, and cross-origin redirects.
- Rotate potentially exposed credentials after deploying the fix.