T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/_common.sh:57
- Finding
- Bearer Token Disclosure Through an Unrestricted API Base URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_common.sh:7`, `scripts/_common.sh:57-66`, and `scripts/_common.sh:187-195` **Vulnerability Type**: Unrestricted credential destination / sensitive information exposure **Risk Level**: High ### Vulnerable Code ```bash MYREELS_BASE_URL="${MYREELS_BASE_URL:-https://api.myreels.ai}" ``` ```bash _myreels_url() { local path="$1" if [[ "$path" =~ ^https?:// ]]; then printf '%s\n' "$path" elif [[ "$path" == /* ]]; then printf '%s%s\n' "${MYREELS_BASE_URL%/}" "$path" else printf '%s/%s\n' "${MYREELS_BASE_URL%/}" "$path" fi } ``` ```bash if [[ "$auth_mode" != "none" && -n "${MYREELS_ACCESS_TOKEN:-}" ]]; then curl_args+=(-H "$(_myreels_auth_header)") fi if [[ -n "$body" ]]; then curl_args+=(-d "$body") fi http_code=$(curl "${curl_args[@]}" "$@" "$(_myreels_url "$path")" 2>"$err_file") || curl_status=$? ``` ### Technical Analysis Authenticated requests add `MYREELS_ACCESS_TOKEN` to the `Authorization` header without first verifying that the resolved destination is the official MyReels HTTPS origin. `MYREELS_BASE_URL` may be supplied through the environment or sourced configuration, and no scheme or hostname allowlist is enforced. Consequently, the token can be transmitted to an attacker-controlled host or over plaintext HTTP. Generation request bodies may also contain private prompts, source-media URLs, or other user-provided generation parameters and would be disclosed to the same destination. Allowing a configurable endpoint can be useful for development, but forwarding production credentials to an unrestricted destination exceeds the minimum privileges necessary for the declared functionality. ### Attack Path 1. An attacker influences the process environment or the MyReels configuration file. 2. The attacker sets `MYREELS_BASE_URL` to a host under their control, such as `http://attacker.example`. 3. The user or agent invokes `myreels-generate.sh`, `myreels-task-get.sh`, ...[truncated 710 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require the resolved authenticated destination to use HTTPS. - Allowlist the exact production origin, such as `https://api.myreels.ai`, before adding the authorization header. - Reject URLs containing unexpected user information, ports, hosts, schemes, or redirects to untrusted origins. - If custom endpoints are required for development, place them behind an explicit opt-in flag and require a separate development token. - Configure `curl` so authenticated requests do not forward credentials across redirects to a different origin. - Resolve and validate the final URL immediately before constructing authentication headers. - Avoid sending production credentials whenever the destination cannot be conclusively verified. ]]>