T09 · Insecure Skill Coding Practices
Error
- Location
- pipeline-mcp.yaml:11
- Finding
- Unauthenticated Externally Bound LLM Endpoint## Vulnerability Details **File Location**: `pipeline-mcp.yaml`, lines 11-19 **Vulnerability Type**: Unauthenticated network service and unrestricted paid API access **Risk Level**: High ### Vulnerable Code ```yaml config: http: enabled: true address: "0.0.0.0:${PORT:-8080}" input: http_server: path: /extract allowed_verbs: [POST] timeout: 60s ``` Requests accepted by this endpoint are subsequently sent to OpenAI: ```yaml - openai_chat_completion: api_key: "${OPENAI_API_KEY}" model: gpt-4o-mini ``` ### Technical Analysis The HTTP service listens on `0.0.0.0`, making it available through every network interface permitted by the host and surrounding network controls. The pipeline does not define authentication or authorization for the `/extract` endpoint. Every accepted request reaches the `openai_chat_completion` processor and uses the operator-provided `OPENAI_API_KEY`. Consequently, any client capable of reaching the service can trigger a paid third-party API operation under the operator's account. The HTTP input also lacks an explicit request-body size limit, rate limit, concurrency limit, and validated upper bound for the client-controlled `max_keywords` value. ### Attack Path 1. An attacker discovers or otherwise reaches the host's exposed port, which defaults to TCP port 8080. 2. The attacker submits unauthenticated `POST` requests to `/extract` containing arbitrary text. 3. The pipeline incorporates the attacker-controlled text and `max_keywords` value into an OpenAI request. 4. The `openai_chat_completion` processor authenticates to OpenAI using the operator's `OPENAI_API_KEY`. 5. The attacker repeats requests, or submits large request bodies, to consume API quota and local processing capacity. 6. Costs and resource consumption accrue to the service operator without the attacker needing access to the API key itself. ### Im ...[truncated 510 chars]
- Remediation
- ## Remediation Suggestions 1. Bind the service to loopback by default, such as `127.0.0.1:${PORT:-8080}`, unless remote access is explicitly required. 2. Require authentication and authorization before allowing requests to reach the pipeline. Use short-lived credentials or securely managed API tokens. 3. If public exposure is necessary, place the service behind a TLS-enabled reverse proxy or API gateway with authentication, network access controls, and request auditing. 4. Add per-client and global rate limits, concurrency limits, request timeouts, and usage quotas. 5. Configure a strict HTTP request-body size limit appropriate for the intended workload. 6. Validate `text` as a bounded string and constrain `max_keywords` to a safe integer range, such as 1 through a documented maximum. 7. Apply OpenAI account-level spending limits, usage alerts, and restricted project credentials to limit financial impact. 8. Avoid exposing detailed credentials or sensitive request content in logs, and monitor for abnormal request volume and API spending.