T09 · Insecure Skill Coding Practices
Warning
- Location
- references/subgraph.md:14
- Finding
- Bearer Token Disclosure Through Unvalidated Subgraph Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `references/subgraph.md:14-19` **Additional Locations**: `references/subgraph.md:24-28, 33-37, 42-46, 51-54, 60-68, 72-76, 81-85, 90-94`; `references/access-rights.md:37-42`; `SKILL.md:28-33, 91` **Vulnerability Type**: Credential disclosure to an environment-controlled network destination **Risk Level**: Medium ### Vulnerable Code ```bash curl -s "$GOTCHIVERSE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \ | python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("parcel","parcels","installationTypes","tileTypes","parcelAccessRights") if n in f])' curl -s "$CORE_SUBGRAPH_URL" -H 'content-type: application/json' ${GOLDSKY_API_KEY:+-H "Authorization: Bearer $GOLDSKY_API_KEY"} --data '{"query":"{ __schema { queryType { fields { name } } } }"}' \ | python3 -c 'import json,sys; f=[x["name"] for x in json.load(sys.stdin)["data"]["__schema"]["queryType"]["fields"]]; print([n for n in ("aavegotchi","erc721Listings","erc1155Listings") if n in f])' ``` ### Technical Analysis The Skill conditionally places `GOLDSKY_API_KEY` in an HTTP `Authorization` header while taking the destination from the environment-controlled `GOTCHIVERSE_SUBGRAPH_URL` or `CORE_SUBGRAPH_URL`. It does not parse or validate either URL before attaching the credential. Consequently, an altered endpoint can point directly to an attacker-controlled server. The next documented subgraph request will then disclose the bearer token. The request also exposes GraphQL variables such as wallet addresses, parcel identifiers, and queried activity. The documentation states that the canonical public endpoints work without an API key. Automatically granting an arbitrary configured endpoint access to the optional credential therefore exce ...[truncated 1174 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the documented public endpoints without an authorization header when authentication is unnecessary. 2. Before attaching `GOLDSKY_API_KEY`, parse the URL and require: - Scheme exactly equal to `https`. - Hostname exactly equal to `api.goldsky.com`. - No embedded username or password. - An expected port and, where practical, an approved path prefix. 3. Do not rely on suffix matching such as `endswith("goldsky.com")`, which can mishandle deceptive hostnames. 4. Separate authenticated and unauthenticated request helpers so credentials are never added to arbitrary URLs. 5. Disable credential-bearing redirects, for example with `curl --max-redirs 0`, and constrain protocols with `curl --proto '=https'`. 6. Use a narrowly scoped, revocable API token and rotate the existing token if these commands may have been run against untrusted endpoints. 7. Validate endpoint configuration before every authenticated request rather than only during initial setup. ]]>