T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/tts.mjs:25
- Finding
- Plaintext Transmission of User-Provided Text to a Non-Loopback Service## Vulnerability Details **File Location**: `scripts/tts.mjs:25-42` **Vulnerability Type**: Plaintext transmission of potentially sensitive user data **Risk Level**: Medium ### Vulnerable Code ```js // 2. 获取后台 API 地址，默认指向你的 Python FastAPI 端口 const apiUrl = process.env.CHATTTS_API_URL || 'http://172.23.252.114:8020'; // 3. 构造请求负载 const payload = { text: text, seed: values.seed ? parseInt(values.seed) : 2048, // 注意：如果想让下面这两个参数生效，你的 Python FastAPI 的 TTSRequest 模型里也需要加上这两个字段 temperature: values.temperature ? parseFloat(values.temperature) : 0.7, top_p: values.top_p ? parseFloat(values.top_p) : 0.7 }; // 4. 发送请求到 Python 服务端 const response = await fetch(`${apiUrl}/v1/audio/speech`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); ``` The documented default endpoint is also plaintext: ```text Requires the local ChatTTS FastAPI server to be running (default target: http://172.23.252.114:8020). ``` ### Technical Analysis The script serializes the complete user-supplied TTS text into a JSON request and transmits it to the default endpoint `http://172.23.252.114:8020`. Although this is a private-network address, it is not a loopback address and may identify a separate host on the local network. HTTP does not provide transport confidentiality, integrity, or authenticated server identity. A network-positioned attacker could observe or modify the request. An attacker able to impersonate or control the service could also return attacker-controlled JSON, including an arbitrary `file_path`. The script prints that value without validating its type or ensuring it belongs to an expected audio-output directory. ### Attack Path 1. A user invokes the Skill with text containing confidential messages, personal information, source code, credentials, or other sensitive content. 2. If `CHATTTS_API_URL` is unset, the script selects the hard-coded non-loopback HTTP endpoint. 3. The script places the complete text ...[truncated 1170 chars]
- Remediation
- ## Remediation Suggestions 1. Default to a loopback endpoint, such as `http://127.0.0.1:8020`, if the ChatTTS service is intended to run on the same machine. 2. Require HTTPS with valid certificate verification whenever the service is hosted on another machine. 3. Reject non-HTTPS URLs unless the configured host is explicitly verified as loopback. 4. Clearly disclose that submitted text is sent to the configured ChatTTS service and may contain sensitive data. 5. Correct the Skill metadata so that it declares `CHATTTS_API_URL` as the required environment variable rather than placing the endpoint URL in the environment-variable list. 6. Validate the response status, content type, and JSON schema before consuming it. 7. Require `data.file_path` to be a string resolving beneath a dedicated, trusted audio-output directory; reject absolute or traversing paths outside that directory. 8. Apply authentication to the ChatTTS API where it is reachable from other hosts, and restrict network access using host firewall rules or equivalent controls.