T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/analyze.rb:76
- Finding
- Arbitrary API Endpoint Override Exposes Media and Bearer Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze.rb:76-104` **Vulnerability Type**: Unrestricted outbound destination and optional plaintext transport **Risk Level**: High ### Vulnerable Code ```ruby endpoint = URI(ENV.fetch('NVIDIA_ENDPOINT', DEFAULT_ENDPOINT)) model = ENV.fetch('NVIDIA_MODEL', DEFAULT_MODEL) encoded = Base64.strict_encode64(File.binread(input_path)) content = [{ type: 'text', text: instruction }] if mime.start_with?('video/') # NVIDIA 的 Omni 端点使用视频块时通常要求 video_url；如官方页面指定了别的字段，可通过 NVIDIA_VIDEO_CONTENT_TYPE 覆盖。 video_type = ENV.fetch('NVIDIA_VIDEO_CONTENT_TYPE', 'video_url') content << if video_type == 'video_url' { type: 'video_url', video_url: { url: "data:#{mime};base64,#{encoded}" } } else { type: video_type, video: "data:#{mime};base64,#{encoded}" } end else content << { type: 'image_url', image_url: { url: "data:#{mime};base64,#{encoded}" } } end payload = { model: model, messages: [{ role: 'user', content: content }], max_tokens: Integer(ENV.fetch('NVIDIA_MAX_TOKENS', '65536')), reasoning_budget: Integer(ENV.fetch('NVIDIA_REASONING_BUDGET', '16384')), stream: false, temperature: Float(ENV.fetch('NVIDIA_TEMPERATURE', '0.6')), top_p: Float(ENV.fetch('NVIDIA_TOP_P', '0.95')) } request = Net::HTTP::Post.new(endpoint) request['Authorization'] = "Bearer #{api_key}" request['Content-Type'] = 'application/json' request.body = JSON.generate(payload) http = Net::HTTP.new(endpoint.host, endpoint.port) http.use_ssl = endpoint.scheme == 'https' ``` ### Technical Analysis The `NVIDIA_ENDPOINT` environment variable accepts an arbitrary URI without validating its scheme, hostname, port, or origin. The script subsequently sends the NVIDIA bearer credential, user instruction, and complete Base64-encoded media file to that URI. TLS is enabled only when the supplied scheme is exactly `https`. A value using `http` is accepted and causes the credential and media to be transmitted without transport ...[truncated 1511 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `NVIDIA_ENDPOINT` configurability if custom endpoints are not essential. 2. If configurability is required, enforce an allowlist of approved HTTPS hosts and ports: - Require `endpoint.scheme == "https"`. - Require the expected NVIDIA hostname, such as `integrate.api.nvidia.com`. - Reject embedded user information, unexpected ports, fragments, and malformed paths. 3. Do not send the bearer credential to a host other than the approved API origin. 4. If redirects are added later, reject cross-origin redirects and never forward authorization headers to redirected hosts. 5. Consider separating endpoint-specific credentials so one provider's credential cannot be sent to another provider. 6. Document the exact external recipient and notify the user before uploading the media. 7. Add automated tests confirming that HTTP URLs, loopback addresses, private network addresses, and unapproved domains are rejected. ]]>