T09 · Insecure Skill Coding Practices
Error
- Location
- vwu-chat.sh:6
- Finding
- Configurable API endpoint permits bearer credential and prompt redirection## Vulnerability Details **File Location**: `vwu-chat.sh`, lines 6-7 and 31-39 **Vulnerability Type**: Unrestricted credential destination **Risk Level**: High ### Vulnerable Code ```zsh VWU_API_KEY="${VWU_API_KEY:-}" VWU_BASE_URL="${VWU_BASE_URL:-https://vwu.ai}" ``` ```zsh response=$(curl -s "$VWU_BASE_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $VWU_API_KEY" \ -d "{ \"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"$PROMPT\"}], \"stream\": false }") ``` ### Technical Analysis The destination of the authenticated API request is taken directly from the environment variable `VWU_BASE_URL`. The script does not validate the URL scheme or verify that the destination host is `vwu.ai` or another explicitly trusted service. The same request includes `VWU_API_KEY` as a bearer credential and includes the user's prompt. Consequently, any process or launch configuration capable of controlling the script's environment can redirect both sensitive values to an arbitrary endpoint. The destination can also use unencrypted HTTP because the script does not restrict the URL scheme to HTTPS. This behavior exceeds the documented configuration, which only instructs users to configure `VWU_API_KEY` and presents vwu.ai as the intended service. ### Attack Path 1. An attacker influences the execution environment through a wrapper script, shell profile, CI configuration, task runner, or compromised parent process. 2. The attacker sets `VWU_BASE_URL` to an endpoint under their control, such as `https://attacker.example`. 3. A user configures a valid `VWU_API_KEY` and invokes `vwu-chat.sh` with a model and prompt. 4. The script sends a request to `https://attacker.example/v1/chat/completions`. 5. The attacker receives the bearer API key, selected model, and complete prompt in the request. ### Impact Assessment ...[truncated 657 chars]
- Remediation
- ## Remediation Suggestions - Remove the configurable base URL if alternate endpoints are not a required feature: ```zsh readonly VWU_BASE_URL="https://vwu.ai" ``` - If endpoint configurability is necessary, parse the URL and enforce an explicit allowlist of trusted HTTPS schemes, hostnames, and ports before attaching the Authorization header. - Configure curl to reject non-HTTPS protocols: ```zsh curl --proto '=https' --tlsv1.2 ... ``` - Do not disable TLS certificate verification. - If redirects are enabled in the future, prevent credentials from being forwarded to a different host. Avoid broad redirect options such as `--location-trusted`. - Consider separating endpoint selection from credential selection so that each allowed host has a dedicated credential and an untrusted endpoint can never receive the vwu.ai key. - Document any supported endpoint override and its trust implications.