T09 · Insecure Skill Coding Practices
- Location
scripts/lipvoice_tts.py:147- Finding
API Key Forwarded to an Unvalidated Remote Download URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/lipvoice_tts.py, lines 147–153
Vulnerability Type: Credential disclosure through an unvalidated remote URL
Risk Level: HighVulnerable Code
python voice_url = query_result['data'].get('voiceUrl') if voice_url: # Determine the output filename if not output: output = f"tts_{task_id[:8]}.wav" # Download audio try: req = urllib.request.Request(voice_url, headers={'sign': API_KEY}) with urllib.request.urlopen(req, timeout=60) as response:Technical Analysis
The synthesis API controls the value of
voice_url. The script uses this URL without validating its scheme, hostname, port, or relationship to the configured LipVoice API origin. It then includes the enterprise API key in thesignHTTP header when requesting that URL.Consequently, any server capable of manipulating the API response can direct the client to send the API key to an arbitrary host. This includes a compromised LipVoice service, compromised upstream infrastructure, or an attacker otherwise capable of altering the returned JSON. Redirects may create an equivalent risk unless each redirect destination is independently validated.
Transmitting the synthesis text and reference audio to the declared LipVoice API is required for the advertised functionality. Forwarding the API credential to an unrestricted download destination is not required and exceeds the minimum privilege necessary to download the generated audio.
Attack Path
- The user invokes the
ttscommand with a valid enterprise API key. - The script creates a synthesis job and polls
/tts/result. - An attacker who controls or compromises the API response supplies an attacker-controlled URL in the
voiceUrlfield, such ashttps://attacker.example/collect. - The script constructs a request to that URL and adds
sign: <LIPVOICE_API_KEY>. - The attacker-con ...[truncated 814 chars]
- The user invokes the
- Remediation
View remediation
Remediation Suggestions
- Do not attach the API key to generated-audio download URLs. The service should return a short-lived presigned URL that can be downloaded without authentication.
- If authentication is unavoidable, parse the URL and require:
- The
httpsscheme. - An exact allowlisted hostname.
- An expected port.
- No embedded user information.
- A path belonging to the expected download endpoint.
- The
- Reject non-HTTPS URLs, IP-literal destinations, unexpected subdomains, and malformed URLs.
- Disable automatic redirects for authenticated requests, or validate the scheme and exact hostname of every redirect before forwarding credentials.
- Separate authenticated API requests from unauthenticated media downloads so credentials cannot be added accidentally to arbitrary URLs.
- Rotate any API key that may already have been used with untrusted API responses.
- Prefer obtaining the API key from a protected environment variable or secret manager. Avoid recommending
--api-keybecause command-line arguments may be exposed through process listings and shell history.