T09 · Insecure Skill Coding Practices
Warning
- Location
- pipeline-mcp.yaml:5
- Finding
- Unauthenticated Public Endpoint Can Consume Operator OpenAI Quota## Vulnerability Details **File Location**: `pipeline-mcp.yaml`, lines 5–12 and 25–27 **Vulnerability Type**: Unauthenticated externally bound service **Risk Level**: Medium ### Vulnerable Code ```yaml http: enabled: true address: "0.0.0.0:${PORT:-8080}" input: http_server: path: /score allowed_verbs: [POST] timeout: 60s ``` Every accepted request invokes the configured remote model: ```yaml - openai_chat_completion: api_key: "${OPENAI_API_KEY}" model: gpt-4o-mini ``` ### Technical Analysis The HTTP service binds to `0.0.0.0`, making it reachable through every available network interface unless an external firewall prevents access. The `/score` endpoint has no configured authentication or authorization. The configuration also shows no application-level rate limit or request-size limit. Each request reaching this endpoint causes a remote OpenAI operation authenticated with the operator-provided `OPENAI_API_KEY`. Consequently, an untrusted network client can cause chargeable API activity using the operator's account. The 60-second timeout limits individual request duration but does not prevent repeated or concurrent requests. ### Attack Path 1. The operator starts `pipeline-mcp.yaml` on a system whose configured port is reachable by an attacker. 2. The service listens on all interfaces, using port 8080 by default. 3. The attacker repeatedly sends unauthenticated `POST` requests containing arbitrary text to `/score`. 4. Each accepted request reaches `openai_chat_completion`. 5. The pipeline authenticates upstream requests with the operator's `OPENAI_API_KEY`. 6. Repeated or concurrent requests consume OpenAI quota, incur costs, and consume local and upstream service capacity. ### Impact Assessment A remote unauthenticated attacker can submit arbitrary sentiment-analysis input and consume resources associated with the service and the operator's OpenAI account. The likely impact includes unexpected API charges, quota exhaustion, ...[truncated 407 chars]
- Remediation
- ## Remediation Suggestions 1. Bind the service to loopback by default, such as `127.0.0.1:${PORT:-8080}`, unless external access is explicitly required. 2. Require strong authentication for `/score`, using an API token, authenticated reverse proxy, or equivalent mechanism. 3. Enforce authorization so each caller can use only its assigned service scope and quota. 4. Add per-client and global rate limits, concurrency limits, and bounded request quotas. 5. Configure a strict request-body size limit and validate that the submitted text is a bounded string before invoking OpenAI. 6. Deploy the endpoint behind a TLS-enabled reverse proxy and restrict ingress with firewall rules or private-network controls. 7. Configure OpenAI account budget alerts and spending limits, and use a dedicated API key with the minimum necessary project scope. 8. Add monitoring and alerting for anomalous request rates, repeated failures, unusual token consumption, and unexpected spending.