T09 · Insecure Skill Coding Practices
Error
- Location
scripts/todozi.py:150- Finding
API Credentials Can Be Redirected to an Arbitrary Server
- Content
View full analysis
Dict: """Make async HTTP request.""" url = f"{self.base_url}/{endpoint}" ``` ### Technical Analysis The client permits its API destination to be supplied through either the `base_url` constructor argument or the `TODOZI_BASE` environment variable. The selected value is not validated before the client attaches the Todozi API key to every request through the `x-api-key` header. There is no enforcement of HTTPS, no trusted-host allowlist, and no requirement for explicit authorization before credentials are sent to a host other than the official `todozi.com` service. Consequently, configuration influence can be converted directly into credential disclosure. This issue does not independently provide a mechanism for modifying the environment or constructor arguments. Exploitation requires an attacker to influence process configuration, deployment settings, or calling code. ### Attack Path 1. The attacker gains the ability to influence `TODOZI_BASE` or the `base_url` argument, such as through a compromised deployment configuration, wrapper application, or environment-injection weakness. 2. The attacker sets the value to a server they control, for example `https://attacker.example/api`. 3. A user or agent invokes any Todozi operation. 4. `_request()` constructs the ...[truncated 922 chars]- Remediation
View remediation