T09 · Insecure Skill Coding Practices
- Location
scripts/src/index.ts:10- Finding
Unvalidated API Base URL Can Disclose the Bearer Credential and Uploaded Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/src/index.ts, lines 10–13 and 74–90
Vulnerability Type: Unvalidated destination for authenticated HTTP requests
Risk Level: HighVulnerable Code
typescript config({ path: join(__dirname, "../../.env") }); // Configuration const API_URL = process.env.ENDPOINTS_API_URL || "https://endpoints.work"; const API_KEY = process.env.ENDPOINTS_API_KEY;typescript async function apiRequest<T>( path: string, options: RequestInit = {} ): Promise<T> { const url = `${API_URL}${path}`; const headers: Record<string, string> = { Authorization: `Bearer ${API_KEY}`, ...((options.headers as Record<string, string>) || {}), }; // Don't set Content-Type for FormData (browser sets it with boundary) if (!(options.body instanceof FormData)) { headers["Content-Type"] = "application/json"; } const response = await fetch(url, { ...options, headers, });Technical Analysis
The application reads
ENDPOINTS_API_URLfrom the local.envfile and uses it directly to construct every API request. No validation restricts the URL to HTTPS, the expectedendpoints.workhost, an approved port, or another explicit allowlist.The same request function unconditionally attaches
ENDPOINTS_API_KEYas a bearer credential. Consequently, any party capable of altering the environment configuration can redirect authenticated requests to an attacker-controlled endpoint. If anhttp://URL is accepted, the credential and request data may also be transmitted without transport encryption.This affects all operations using
apiRequest(). Scanning operations present additional exposure because their multipart request bodies can contain user-provided text or complete local document contents.Attack Path
- An attacker, compromised installation process, or malicious local configuration modifies the project
.envfile or otherwise controls `ENDPOINTS_API ...[truncated 1324 chars]
- An attacker, compromised installation process, or malicious local configuration modifies the project
- Remediation
View remediation
Remediation Suggestions
- Remove support for an arbitrary production API origin where possible and use a fixed constant such as
https://endpoints.work. - If configurability is required, parse the value with
new URL()and enforce:https:exclusively.- An explicit hostname allowlist.
- Approved ports only.
- No embedded username or password.
- No unexpected path, query string, or fragment.
- Attach the
Authorizationheader only after confirming that the final request destination is trusted. - Disable automatic redirects for authenticated requests, or manually process redirects and revalidate every target before resending credentials.
- Fail closed when URL validation fails; do not fall back to an untrusted destination.
- Protect
.envwith restrictive filesystem permissions, exclude it from version control, and document that configuration integrity is security-sensitive. - Rotate the API key if there is any indication that requests were previously sent to an unintended host.
- Add automated tests covering HTTP URLs, lookalike domains, subdomain confusion, embedded credentials, nonstandard ports, and cross-origin redirects.
- Remove support for an arbitrary production API origin where possible and use a fixed constant such as