T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/merge-pdf.py:194
- Finding
- Arbitrary Upload Destination Can Expose PDF Contents and API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/merge-pdf.py`, lines 59-60, 82-85, and 194 **Vulnerability Type**: Unrestricted security-sensitive endpoint override **Risk Level**: High ### Vulnerable Code ```python url = base_url.rstrip("/") + CREATE_PATH headers = make_headers(api_key) ``` ```python resp = requests.post(url, headers=headers, files=files, timeout=timeout_s) ``` ```python url = base_url.rstrip("/") + f"/api/{job_id}" headers = make_headers(api_key) resp = requests.get(url, headers=headers, timeout=timeout_s) ``` ```python ap.add_argument( "--base-url", default=os.getenv("SOLUTIONS_BASE_URL", DEFAULT_BASE_URL), help="Base URL override" ) ``` ### Technical Analysis The command-line argument and inherited `SOLUTIONS_BASE_URL` environment variable can replace the documented Cross-Service-Solutions API endpoint. The supplied value is not checked against an approved hostname, scheme, port, or path. The program subsequently sends the bearer API key in the `Authorization` header and uploads all selected PDF contents to the resulting URL. Consequently, anyone capable of controlling the process arguments or environment can redirect these sensitive values to an arbitrary server. The implementation also does not reject plaintext `http://` destinations. The base-URL override is not necessary for the Skill's declared operation against its single documented provider and therefore exceeds the minimum network authority required for that operation. ### Attack Path 1. An attacker influences the Skill invocation or sets `SOLUTIONS_BASE_URL` in its execution environment. 2. The attacker assigns a URL under their control, such as `http://attacker.example`. 3. A user invokes the normal PDF merge workflow with valid documents and an API key. 4. `create_job()` sends the documents and `Authorization: Bearer <API_KEY>` to the attacker-controlled endpoint. 5. The attacker records the credential and PDF contents and can return a plausi ...[truncated 658 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--base-url` option and `SOLUTIONS_BASE_URL` override if alternate service endpoints are not an explicit functional requirement. 2. If endpoint configurability is required, parse the URL and enforce: - The `https` scheme. - An exact allowlist of approved hostnames. - Approved ports only. - The expected path prefix. - No embedded username or password. 3. Reject redirects, or validate every redirect destination before following it. 4. Avoid obtaining security-sensitive network destinations from ambient environment variables. 5. Display or otherwise confirm the destination and exact input files before uploading sensitive documents. 6. Use a narrowly scoped, revocable API credential and document the provider's data retention and deletion behavior. ]]>