T09 · Insecure Skill Coding Practices
Error
- Location
_wallet.ts:126- Finding
DFNS Authentication Token Can Be Sent to an Arbitrary Endpoint
- Content
View full analysis
{ const apiUrl = process.env.DFNS_API_URL ?? 'https://api.dfns.io'; const authToken = process.env.DFNS_AUTH_TOKEN!; const walletId = process.env.DFNS_WALLET_ID!; const response = await fetch(`${apiUrl}/wallets/${walletId}`, { headers: { Authorization: `Bearer ${authToken}`, 'Content-Type': 'application/json', }, }); ``` ### Technical Analysis The Skill permits `DFNS_API_URL` to specify an unrestricted URL and then sends the sensitive `DFNS_AUTH_TOKEN` to that destination in an `Authorization` header. There is no validation of the URL scheme, hostname, port, or origin. Using the DFNS authentication token with the official DFNS API is necessary for the declared DFNS wallet functionality. However, sending the token to any environment-controlled endpoint exceeds minimum privilege. An attacker who can influence runtime environment variables could redirect the request to an attacker-controlled HTTPS or plaintext HTTP server. The DFNS credential private key is separately passed to `createDfnsWallet`, whose implementation resides in the unavailable `../../core/src/index.js`. This audit therefore cannot determine whether that dependency handles the credential private key safely. ### Attack Path 1. The attacker gains the ability to influence the Skill's runtime configuration or deployment environment. 2. The attacker sets `DFNS_API_URL` to an endpoint they control, such as `https://attacker.example`. 3. A user invokes any command that initializes DFNS wallet mode. 4. `resolveDfnsWalletMetadata()` sends `Authorization: Bearer ` to the attacker's server. 5. The attacker captures the token and attempts to reuse i ...[truncated 586 chars]- Remediation
View remediation