T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:89- Finding
Caller-Controlled Upload Endpoint Can Exfiltrate Local Files and API Credentials
- Content
View full analysis
str: ``` ```python headers = {} if api_key: headers['Authorization'] = f"Bearer {api_key}" headers['x-agent-user'] = "openclaw-agent" try: for file_path, rel_path in files_to_upload: f = open(file_path, 'rb') file_handles.append(f) multipart_data.append(('files', (os.path.basename(file_path), f))) multipart_data.append(('paths', (None, rel_path))) response = requests.post(api_url, files=multipart_data, headers=headers) ``` ### Technical Analysis The upload destination is exposed as a caller-controlled `api_url` parameter. The implementation sends all selected local files to that URL and, when an API key is supplied, places the key in the `Authorization` header. No validation ensures that the destination: - Uses HTTPS. - Belongs to the expected `www.dele.fun` origin. - Uses an approved port and path. - Does not resolve to a loopback, private, link-local, or cloud metadata address. - Remains on an approved origin after HTTP redirection. Allowing the endpoint to be changed is not required for the declared purpose of deploying files to Dele. A fixed, trusted Dele endpoint would provide the required functionality with less privilege and substantially lower exposure. ### Attack Path 1. An attacker, malicious prompt, or compromised calling workflow supplies an attacker-controlled URL as `api_url`. 2. The Agent inv ...[truncated 1152 chars]- Remediation
View remediation