T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/qianfanclawhub.py:132
- Finding
- Baidu API Key Disclosure Through a User-Controlled API Endpoint## Vulnerability Details **File Location**: `scripts/qianfanclawhub.py`, lines 14–15, 46–47, 75–78, 132, and 153 **Vulnerability Type**: Credential disclosure through an unrestricted network destination **Risk Level**: High ### Vulnerable Code ```python def __init__(self, endpoint=None, api_key=None, workdir=None): self.endpoint = endpoint or 'https://appbuilder.baidu.com' self.api_key = api_key ``` ```python headers = { 'Content-Type': 'application/json', 'Authorization': f'Bearer {self.api_key}' } response = requests.post( f"{self.endpoint}/v2/skills/search", json=params, headers=headers ) ``` ```python url = f"{self.endpoint}/v2/skills/download" params = {"slugName": slug_name} headers = {'Authorization': f'Bearer {self.api_key}'} response = requests.get( url, params=params, headers=headers, timeout=60 ) ``` ```python parser.add_argument( '--endpoint', type=str, default=None, help='指定 API 服务器地址' ) ``` ```python client = QianfanClawhubClient( endpoint=args.endpoint, api_key=api_key, workdir=args.workdir ) ``` ### Technical Analysis The command-line `--endpoint` option permits the caller to replace the trusted default Baidu endpoint with an arbitrary URL. The selected endpoint is used directly for both search and download requests, and the value of the `BAIDU_API_KEY` environment variable is attached as an HTTP Bearer credential. The implementation does not validate: - The URL scheme. - Whether TLS is required. - Whether the destination hostname belongs to Baidu. - Whether the destination is a local, private, or attacker-controlled server. - Whether the supplied endpoint is authorized to receive the Baidu credential. Consequently, an endpoint such as `https://attacker.example` receives the API key when either supported operation is invoked. A plaintext `http://` endpoint ...[truncated 1893 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--endpoint` from production builds if alternative endpoints are not required for the declared functionality. 2. If endpoint customization is required, parse the URL and enforce: - An `https` scheme. - An exact allowlist of approved Baidu hostnames. - An expected port. - No embedded user information. 3. Do not rely on substring or suffix checks that can be bypassed with hostnames such as `baidu.com.attacker.example`. 4. Refuse to attach `BAIDU_API_KEY` to localhost, private-network, link-local, or unapproved destinations. 5. Use separate, low-privilege test credentials for development endpoints rather than forwarding the production API key. 6. Apply least privilege to the Baidu credential and rotate any key that may have been exposed. 7. Add connection and read timeouts to every request, including the search request. 8. Add automated tests proving that credentials are never sent when the endpoint is not an explicitly approved HTTPS origin.