T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/recall.py:160
- Finding
- Bearer Credential and Sensitive Query Exposure over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `config.json:2` and `scripts/recall.py:160-166` **Vulnerability Type**: Plaintext transmission of sensitive information and sensitive data in URL query parameters **Risk Level**: Medium ### Vulnerable Code `config.json:2`: ```json "base_url": "http://127.0.0.1:8000", ``` `scripts/recall.py:160-166`: ```python request = urllib.request.Request( url=f"{endpoint}?{urllib.parse.urlencode(params)}", headers={ "Accept": "application/json", "Authorization": f"Bearer {api_key}", }, method="GET", ) ``` ### Technical Analysis The script permits an unrestricted `base_url` and does not validate the URL scheme or require TLS for non-loopback destinations. The bundled configuration uses loopback HTTP, but an operator can configure an arbitrary remote `http://` endpoint. In that case, the bearer API key, request, and server response are transmitted without transport encryption. The complete user-supplied question and retrieval parameters are encoded into the URL query string. URLs are commonly recorded by web-server access logs, reverse proxies, monitoring platforms, debugging tools, and error telemetry. Consequently, confidential questions may be exposed even when the endpoint uses HTTPS, because TLS protects data in transit but does not prevent endpoint infrastructure from logging URLs. The API key is correctly placed in the `Authorization` header and is not printed by the script. The vulnerability arises from allowing plaintext remote transport and placing sensitive query content in the URL. ### Attack Path 1. An operator or deployment configuration changes `base_url` to a remote endpoint using the `http://` scheme. 2. A user invokes the skill with a confidential knowledge-base question. 3. The script appends the question and all retrieval parameters to the request URL. 4. The script sends the request over plaintext HTTP with the knowledge-base API key in the `Authorization` he ...[truncated 1134 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for all non-loopback destinations. Parse `base_url` with `urllib.parse.urlparse` and reject unsupported schemes and remote `http://` URLs. 2. If loopback HTTP must remain supported for local development, allow it only for explicit loopback addresses such as `127.0.0.1`, `::1`, and `localhost`, and document that exception. 3. Replace the GET request with a POST request and place the question and retrieval options in an `application/json` request body. 4. Continue sending the API key only through the `Authorization` header. Never include it in URLs, output, logs, or exception messages. 5. Redact questions and other sensitive fields from request diagnostics and operational logs. 6. Apply short credential lifetimes, least-privilege knowledge-base permissions, and routine key rotation to limit the impact of credential disclosure. 7. Consider rejecting URLs containing user information, fragments, or unexpected schemes and explicitly validate the intended LibRAG endpoint before sending credentials. ]]>