T09 · Insecure Skill Coding Practices
Error
- Location
scripts/otp_client.py:41- Finding
Basic Authentication credentials can be redirected to an attacker-controlled endpoint
- Content
View full analysis
dict: url = f"{self._base_url}{path}" resp = requests.request(method, url, headers=self._headers, json=payload) ``` ### Technical Analysis The client accepts an arbitrary `base_url` while preparing a reusable `Authorization` header containing the Base64-encoded `dev_key:dev_secret` credential pair. Every subsequent request sends that header to the configured URL. Base64 is the encoding required by HTTP Basic Authentication; it is not encryption. Anyone who receives the header can trivially recover the original credentials. Because the client does not enforce HTTPS, validate the hostname, restrict ports, or allowlist the EngageLab API origin, an untrusted or mistakenly configured `base_url` can redirect credentials to an attacker-controlled endpoint. The default endpoint, `https://otp.api.engagelab.cc`, is consistent with the Skill's declared functionality. The vulnerability arises from permitting unrestricted endpoint replacement while automatically attaching privileged credentials. ### Attack Path 1. A victim application initializes `EngageLabOTP` with valid EngageLab credentials. 2. An attacker influences the `base_url` constructor argument through configuration injection, an environment setting, a compromised wrapper, or unsafe user input. 3. The attacker supplies a URL such as an attacker-controlled HTTPS server or a plaintext HTTP endpoint. 4. The victim calls any c ...[truncated 1062 chars]- Remediation
View remediation