T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/call_api.py:47
- Finding
- Configurable API Endpoint Allows API Key Exfiltration## Vulnerability Details **File Location**: `scripts/config.py:10-16`, `scripts/config.py:44-65`, and `scripts/call_api.py:47-69` **Vulnerability Type**: Unrestricted API endpoint override and plaintext credential storage **Risk Level**: High ### Vulnerable Code `scripts/config.py:10-16`: ```python model_config = SettingsConfigDict( env_prefix="XBY_GAOKAO_", env_file=".env", env_file_encoding="utf-8", extra="ignore", ) # API configuration base_url: str = "https://mcp.xiaobenyang.com" mcp_id: str = "1820705335657482" api_key: str = "" ``` `scripts/config.py:44-65`: ```python def save_api_key_to_env(api_key: str) -> bool: """Save API key to the .env file.""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"Failed to save API key: {e}") return False ``` `scripts/call_api.py:47-69`: ```python url = f"{settings.base_url}/api" mcp_id = mcp_id or settings.mcp_id api_key = get_api_key() if not api_key: raise UpstreamError("API key is not configured; call set_api_key() first") headers = { "XBY-APIKEY": api_key, "func": tool_name, "mcpid": mcp_id, "Content-Type": "application/json", } t0 = time.time() try: resp = self._session.post( url=url, headers=header ...[truncated 2718 chars]
- Remediation
- ## Remediation Suggestions 1. Remove runtime endpoint configurability if it is not required. Use a constant trusted API origin: ```python API_ORIGIN = "https://mcp.xiaobenyang.com" ``` 2. If endpoint configuration is required, validate it before every credential-bearing request: - Require the `https` scheme. - Require an explicit allowlist of trusted hostnames. - Reject embedded credentials, unexpected ports, fragments, and malformed URLs. - Resolve redirects carefully and prevent redirects to untrusted origins. 3. Do not load security-sensitive endpoint configuration from an untrusted working-directory `.env` file. Use a configuration file with verified ownership and restrictive permissions, or obtain the endpoint from trusted deployment configuration. 4. Store API keys in an operating-system credential manager or dedicated secret-management service. If file storage is unavoidable, create the file atomically with owner-only permissions such as `0600`, verify ownership before reading it, and avoid preserving attacker-controlled configuration entries. 5. Separate secret storage from general application configuration so saving an API key cannot activate or preserve an untrusted endpoint override. 6. Add tests confirming that: - HTTP endpoints are rejected. - Non-allowlisted hosts are rejected. - Credentials are never forwarded during cross-origin redirects. - Secret files have restrictive permissions. - Malicious `.env` endpoint overrides cannot change the credential destination.