T09 · Insecure Skill Coding Practices
Error
- Location
- vwu-chat.sh:6
- Finding
- Unvalidated API Endpoint Override Exposes Bearer Credentials and Prompt Data## Vulnerability Details **File Location**: `vwu-chat.sh`, lines 6–39 **Vulnerability Type**: Unvalidated destination for authenticated API requests **Risk Level**: High ### Vulnerable Code ```zsh VWU_API_KEY="${VWU_API_KEY:-}" VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}" if [ -z "$VWU_API_KEY" ]; then echo "❌ 错误: 未设置 VWU_API_KEY" echo "" echo "请按以下步骤获取 API key:" echo "1. 访问 https://vwu.ai" echo "2. 登录并进入控制台" echo "3. 在「令牌」页面生成新的 API key" echo "4. 设置环境变量: export VWU_API_KEY='your-key'" exit 1 fi MODEL="${1:-}" PROMPT="${2:-}" if [ -z "$MODEL" ] || [ -z "$PROMPT" ]; then echo "用法: vwu-chat <model> <prompt>" echo "" echo "可用模型:" cat "$(dirname "$0")/models.txt" | sed 's/^/ - /' exit 1 fi # 调用 API response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }") ``` ### Technical Analysis The script accepts `VWU_BASE_URL` directly from its inherited environment without validating the URL scheme, hostname, port, or ownership of the destination. It subsequently attaches `VWU_API_KEY` as an authorization bearer token to a request sent to that destination. Consequently, any process, wrapper, CI configuration, shell profile, or other actor capable of influencing the script's environment can redirect the authenticated request from the intended `https://vwu.ai` service to an attacker-controlled endpoint. The endpoint override is also not disclosed in `SKILL.md`, reducing the likelihood that users will recognize this trust boundary. The request body includes the model name and complete user prompt, so both authentication material and potentially sensitive prompt data are exposed when redirection o ...[truncated 1287 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the environment-controlled endpoint override if alternate servers are not a required feature: ```zsh readonly VWU_BASE_URL="https://vwu.ai" ``` 2. If endpoint customization is required, validate the parsed destination against an explicit allowlist of trusted HTTPS hosts. Reject non-HTTPS schemes, unexpected ports, embedded credentials, malformed URLs, and unapproved subdomains. 3. Do not attach `Authorization` headers until the destination has passed validation. Keep authenticated requests restricted to the intended origin. 4. Ensure that redirects are not followed to another origin while retaining credentials. If redirect support is introduced later, revalidate every destination and strip authorization data from cross-origin requests. 5. Document all supported endpoint configuration behavior and its security implications in `SKILL.md`. 6. Construct the JSON request body with a JSON-aware tool rather than direct string interpolation: ```zsh payload=$(jq -n \ --arg model "$MODEL" \ --arg prompt "$PROMPT" \ '{model: $model, messages: [{role: "user", content: $prompt}], stream: false}') response=$(curl --silent --show-error --fail-with-body \ "https://vwu.ai/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ --data-binary "$payload") ``` 7. Rotate any API key that may have been used while `VWU_BASE_URL` pointed to an untrusted destination, and review account usage for unauthorized requests.