T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/src/index.ts:10
- Finding
- Unvalidated API Base URL Can Disclose the Bearer Credential and Uploaded Data## Vulnerability Details **File Location**: `scripts/src/index.ts`, lines 10–13 and 74–90 **Vulnerability Type**: Unvalidated destination for authenticated HTTP requests **Risk Level**: High ### Vulnerable Code ```typescript config({ path: join(__dirname, "../../.env") }); // Configuration const API_URL = process.env.ENDPOINTS_API_URL || "https://endpoints.work"; const API_KEY = process.env.ENDPOINTS_API_KEY; ``` ```typescript async function apiRequest<T>( path: string, options: RequestInit = {} ): Promise<T> { const url = `${API_URL}${path}`; const headers: Record<string, string> = { Authorization: `Bearer ${API_KEY}`, ...((options.headers as Record<string, string>) || {}), }; // Don't set Content-Type for FormData (browser sets it with boundary) if (!(options.body instanceof FormData)) { headers["Content-Type"] = "application/json"; } const response = await fetch(url, { ...options, headers, }); ``` ### Technical Analysis The application reads `ENDPOINTS_API_URL` from the local `.env` file and uses it directly to construct every API request. No validation restricts the URL to HTTPS, the expected `endpoints.work` host, an approved port, or another explicit allowlist. The same request function unconditionally attaches `ENDPOINTS_API_KEY` as a bearer credential. Consequently, any party capable of altering the environment configuration can redirect authenticated requests to an attacker-controlled endpoint. If an `http://` URL is accepted, the credential and request data may also be transmitted without transport encryption. This affects all operations using `apiRequest()`. Scanning operations present additional exposure because their multipart request bodies can contain user-provided text or complete local document contents. ### Attack Path 1. An attacker, compromised installation process, or malicious local configuration modifies the project `.env` file or otherwise controls `ENDPOINTS_API ...[truncated 1324 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for an arbitrary production API origin where possible and use a fixed constant such as `https://endpoints.work`. 2. If configurability is required, parse the value with `new URL()` and enforce: - `https:` exclusively. - An explicit hostname allowlist. - Approved ports only. - No embedded username or password. - No unexpected path, query string, or fragment. 3. Attach the `Authorization` header only after confirming that the final request destination is trusted. 4. Disable automatic redirects for authenticated requests, or manually process redirects and revalidate every target before resending credentials. 5. Fail closed when URL validation fails; do not fall back to an untrusted destination. 6. Protect `.env` with restrictive filesystem permissions, exclude it from version control, and document that configuration integrity is security-sensitive. 7. Rotate the API key if there is any indication that requests were previously sent to an unintended host. 8. Add automated tests covering HTTP URLs, lookalike domains, subdomain confusion, embedded credentials, nonstandard ports, and cross-origin redirects.