T09 · Insecure Skill Coding Practices
Error
- Location
scripts/manage_collaborators.js:76- Finding
Untrusted Share-Link Hosts Can Receive ShareOne API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/manage_collaborators.js:76-82,scripts/update_share_settings.js:84-92, andscripts/shareone_client.js:418-449
Vulnerability Type: Credential disclosure through attacker-controlled API origin
Risk Level: HighVulnerable Code
js // scripts/manage_collaborators.js:76-82 if (raw.includes('://')) { const parsed = new URL(raw); if (!explicitBaseUrl) { process.env.SHAREONE_BASE_URL = `${parsed.protocol}//${parsed.host}`; } path = parsed.pathname; }js // scripts/update_share_settings.js:84-92 if (raw.includes('://')) { const parsed = new URL(raw); if (!explicitBaseUrl) { const host = parsed.hostname.toLowerCase(); process.env.SHAREONE_BASE_URL = host === 'shareone.vip' || host.endsWith('.shareone.vip') ? 'https://shareone.app' : `${parsed.protocol}//${parsed.host}`; } path = parsed.pathname; }js // scripts/shareone_client.js:418-449 async function buildShareOneRequest(apiPath, options = {}) { const targetUrl = appendPath(getBaseUrl(), apiPath); const headers = { ...(options.headers || {}) }; const credentialMode = await detectCredentialMode(); if (credentialMode.mode === CREDENTIAL_MODE_SUDOWORK_PROXY && options.authRequired !== false) { delete headers['X-API-Key']; delete headers['x-api-key']; return { url: process.env.SUDOWORK_AUTH_PROXY_URL, options: { ...options, headers: { ...headers, Authorization: `Bearer ${process.env.SUDOWORK_AUTH_PROXY_TOKEN}`, 'X-Secret-Namespace': 'service:shareone', 'X-Remote-URL': targetUrl, 'X-Auth-Scheme': 'header', 'X-Auth-Header': 'X-API-Key', 'X-Secret-Key': 'X-API-Key' }, }, }; } if (op ...[truncated 3026 chars]- Remediation
View remediation
Remediation Suggestions
- Never infer the API origin from a share-link input. Parse only the resource reference and keep the API origin fixed to the configured ShareOne endpoint.
- Require full share URLs to use HTTPS and an explicit allowlist of canonical ShareOne hostnames.
- Reject unknown hosts instead of treating them as custom API deployments.
- If custom deployments are a required feature, accept their origin only through a separate, explicit
--base-urloption accompanied by clear user approval. - Keep credentials scoped per origin. Never reuse the production ShareOne API key for an arbitrary custom deployment.
- Apply the same centralized URL validation to every script that accepts a full ShareOne link.
- In the Sudowork proxy layer, independently enforce an allowlist for
X-Remote-URL; callers should not be able to select an arbitrary credential-injection destination. - Add regression tests proving that arbitrary domains, HTTP URLs, deceptive suffixes, user-info URLs, and lookalike domains are rejected before any authenticated request occurs.