T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/validate_config.py:173
- Finding
- Bearer Credential Disclosure and SSRF Through an Untrusted Custom Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/validate_config.py`, lines 173–180 and 240–259 **Vulnerability Type**: Credential disclosure and server-side request forgery through insufficient URL validation **Risk Level**: High ### Vulnerable Code ```python def validate_base_url(config: Dict) -> Tuple[bool, str]: """Validate the base URL from foxcode provider.""" providers = config.get("models", {}).get("providers", {}) foxcode = providers.get("foxcode", {}) base_url = foxcode.get("baseUrl", "") if not base_url: return False, "baseUrl is empty" if base_url not in VALID_ENDPOINTS: # Check if it's a valid URL format if not re.match(r'^https?://[^\s/]+', base_url): return False, f"Invalid URL format: {base_url}" # It's a custom URL, just warn return True, f"Custom endpoint (not in known list): {base_url}" return True, f"Valid endpoint: {base_url}" ``` ```python def test_endpoint_connection(config: Dict) -> Tuple[bool, str]: """Test connection to the foxcode endpoint.""" providers = config.get("models", {}).get("providers", {}) foxcode = providers.get("foxcode", {}) base_url = foxcode.get("baseUrl", "") api_key = foxcode.get("apiKey", "") # Resolve environment variable if needed if api_key.startswith("${") and api_key.endswith("}"): env_var = api_key[2:-1] api_key = os.environ.get(env_var, "") if not api_key: return False, f"Cannot test: environment variable {env_var} not set" try: req = Request(base_url, method="HEAD") req.add_header("Authorization", f"Bearer {api_key}") req.add_header("User-Agent", "Foxcode-Validator/1.0") with urlopen(req, timeout=15) as response: return True, f"Connection successful (status: {response.getcode()})" ``` ### Technical Analysis The validator treats any string matching a basic HTTP or HTTPS URL expression as an accep ...[truncated 2435 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce an exact allowlist of documented HTTPS endpoint URLs before attaching credentials. 2. Parse URLs with `urllib.parse.urlsplit()` rather than relying on a permissive regular expression. 3. Reject: - Plain HTTP URLs - URLs containing user-information components - Unexpected ports - Loopback, link-local, private, reserved, multicast, and unspecified IP addresses - Hostnames that resolve to those address classes 4. Separate reachability checks from authentication checks. A generic reachability test should not include the API key. 5. If custom providers must be supported, require explicit informed confirmation before transmitting a credential and clearly display the normalized destination. 6. Disable redirects for authenticated validation requests, or independently validate every redirect target and remove the `Authorization` header when the origin changes. 7. Pin the expected hostname and consider verifying the final connected address to reduce DNS-rebinding exposure. 8. Add regression tests proving that arbitrary domains, private addresses, HTTP URLs, and cross-origin redirects cannot receive credentials. ]]>