T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/quickstart.py:29
- Finding
- Unvalidated API Endpoint in Quickstart Script Redirects Authenticated Requests## Vulnerability Details **File Location**: `scripts/quickstart.py:29-40` **Vulnerability Type**: Unvalidated credential-bearing API endpoint **Risk Level**: Medium ### Vulnerable Code ```python endpoint = get_env("AGENTRUN_ENDPOINT") access_key_id = get_env("ALICLOUD_ACCESS_KEY_ID") access_key_secret = get_env("ALICLOUD_ACCESS_KEY_SECRET") security_token = os.getenv("ALICLOUD_SECURITY_TOKEN") or os.getenv("ALIBABA_CLOUD_SECURITY_TOKEN") config = open_api_models.Config( access_key_id=access_key_id, access_key_secret=access_key_secret, endpoint=endpoint, ) if security_token: config.security_token = security_token ``` ### Technical Analysis The `AGENTRUN_ENDPOINT` environment variable is passed directly to the Alibaba Cloud SDK client without checking that it identifies an approved Alibaba Cloud AgentRun service. The project documents a finite set of official public and VPC endpoints in `references/endpoints.md`, but the implementation does not enforce that list. The same configuration object contains the AccessKey ID, AccessKey secret, and optional temporary security token used to sign requests. The secret is normally used locally for signing rather than transmitted directly; however, a malicious endpoint can receive signed authentication metadata, the AccessKey ID, an optional security token, request parameters, and resource information. Depending on the signature freshness and SDK behavior, captured signed requests may also present a limited replay risk. Exploitation requires an attacker to influence the process environment, launch configuration, wrapper script, CI configuration, or agent-generated command that sets `AGENTRUN_ENDPOINT`. ### Attack Path 1. The attacker influences `AGENTRUN_ENDPOINT` and sets it to an attacker-controlled host. 2. A user or automation process supplies valid Alibaba Cloud credentials and runs `quickstart.py`. 3. The script constructs an SD ...[truncated 917 chars]
- Remediation
- ## Remediation Suggestions - Replace the arbitrary endpoint variable with a validated region identifier and derive the endpoint from a static region-to-host mapping. - If custom endpoints are required, parse and normalize the value before use and allow only the exact official hosts listed in `references/endpoints.md`. - Require TLS and reject plaintext HTTP, embedded user information, unexpected ports, IP literals, malformed hostnames, and hostname suffix tricks. - Ensure redirects are disabled or restricted so that authenticated requests cannot be redirected to an unapproved host. - Prefer short-lived RAM credentials with only the `ListAgentRuntimes` permission required by this script. - Add automated tests for malicious endpoint values such as look-alike domains, subdomain suffix attacks, user-information syntax, IP addresses, and non-TLS URLs.