T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/setup-webhook.js:7
- Finding
- Credentials and Sensitive Data Can Be Redirected to an Arbitrary API Origin## Vulnerability Details **File Location**: `worker-config.json:3`; `scripts/register.js:6, 24-28`; `scripts/setup-webhook.js:7-8, 27-35`; `scripts/check-jobs.js:6-7, 43-45, 63-67`; `scripts/bid.js:6-7, 18-22`; `scripts/deliver.js:6-7, 32-36`; `scripts/status.js:6-7, 12-14, 32-34, 41-43` **Vulnerability Type**: User-controlled API origin used for sensitive authenticated requests **Risk Level**: High ### Vulnerable Code `worker-config.json:3`: ```json "apiBase": "https://moltmarket.store", ``` `scripts/register.js:6, 24-28`: ```js const API = process.env.MOLT_API_BASE || 'https://moltmarket.store'; const res = await fetch(`${API}/auth/register`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name, email, password, skills, description: description || undefined }), }); ``` `scripts/setup-webhook.js:7-8, 27-35`: ```js const API = config.apiBase || 'https://moltmarket.store'; const KEY = config.apiKey || process.env.MOLT_API_KEY; const res = await fetch(`${API}/webhooks`, { method: 'POST', headers: { Authorization: `Bearer ${KEY}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ url, events, skill_filter: config.skills || [], category_filter: config.categories || [], }), }); ``` The other authenticated scripts use the same configurable `apiBase` value when transmitting the bearer token. ### Technical Analysis Registration legitimately requires transmitting the supplied name, email, password, skills, and description to the marketplace. Webhook registration and other account operations also legitimately require API authentication. However, the destination is taken from the `MOLT_API_BASE` environment variable or the editable `worker-config.json` file without enforcing HTTPS, validating the hostname, or obtaining confirmation before sending credentials to a non-default origin. This destination flexibil ...[truncated 1747 chars]
- Remediation
- ## Remediation Suggestions - Pin credential-bearing requests to `https://moltmarket.store`. - If custom API endpoints are an actual requirement, enforce HTTPS and validate the normalized hostname against an administrator-controlled allowlist. - Require explicit interactive confirmation before sending credentials to any non-default origin. - Reject URLs containing embedded credentials, unexpected ports, unsupported protocols, or ambiguous hostname encodings. - Configure redirects manually and never forward `Authorization` headers or registration credentials across origins. - Separate unauthenticated public-job requests from authenticated account requests so credentials are attached only where required. - Document the custom-endpoint capability and its security implications. - Add tests confirming that HTTP destinations, unapproved hosts, and cross-origin redirects are rejected.