T09 · Insecure Skill Coding Practices
Error
- Location
scripts/upload.sh:29- Finding
Figshare token transmitted to an unvalidated response-controlled upload URL
- Content
View full analysis
> file_id=$FILE_ID upload_url=$UPLOAD_URL" PARTS=$(curl -sS "${AUTH[@]}" "$UPLOAD_URL") NPARTS=$(echo "$PARTS" | jq '.parts | length') echo ">> uploading $NPARTS part(s)" echo "$PARTS" | jq -c '.parts[]' | while read -r part; do NO=$(echo "$part" | jq -r '.partNo') START=$(echo "$part" | jq -r '.startOffset') END=$(echo "$part" | jq -r '.endOffset') LEN=$((END - START + 1)) echo " part $NO: bytes $START-$END ($LEN)" dd if="$FILE" bs=1 skip="$START" count="$LEN" status=none \ | curl -sS -X PUT --data-binary @- "${AUTH[@]}" "$UPLOAD_URL/$NO" >/dev/null done ``` The corresponding raw-flow instructions also recommend forwarding the token to the returned upload URL: ```bash dd if="$FILE" bs=1 skip=$START count=$((END-START+1)) 2>/dev/null \ | curl -s -X PUT --data-binary @- "${upload_url}/${partNo}" \ -H "Authorization: token $FIGSHARE_TOKEN" ``` ### Technical Analysis The script obtains `upload_url` from a JSON API response and uses it directly as a destination for subsequent authenticated requests. It does not validate: - The URL scheme. - The destination hostname. - Whether the destination belongs to an approved Figshare upload service. - Whether the authorization header is required by that service. - Whether the derived part URL remains within the expected origin. The `AUTH` array contains the user's personal Figshare token: ```bash AUTH=(-H "Authorization: token $FIGSHARE_TOKEN") ``` It is supplied to both the request for the part layout and every part-upload request. Consequently, the bearer credential is disclosed t ...[truncated 1876 chars]- Remediation
View remediation