T09 · Insecure Skill Coding Practices
- Location
scripts/tts.mjs:25- Finding
Plaintext Transmission of User-Provided Text to a Non-Loopback Service
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tts.mjs:25-42
Vulnerability Type: Plaintext transmission of potentially sensitive user data
Risk Level: MediumVulnerable Code
js // 2. 获取后台 API 地址，默认指向你的 Python FastAPI 端口 const apiUrl = process.env.CHATTTS_API_URL || 'http://172.23.252.114:8020'; // 3. 构造请求负载 const payload = { text: text, seed: values.seed ? parseInt(values.seed) : 2048, // 注意：如果想让下面这两个参数生效，你的 Python FastAPI 的 TTSRequest 模型里也需要加上这两个字段 temperature: values.temperature ? parseFloat(values.temperature) : 0.7, top_p: values.top_p ? parseFloat(values.top_p) : 0.7 }; // 4. 发送请求到 Python 服务端 const response = await fetch(`${apiUrl}/v1/audio/speech`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });The documented default endpoint is also plaintext:
text Requires the local ChatTTS FastAPI server to be running (default target: http://172.23.252.114:8020).Technical Analysis
The script serializes the complete user-supplied TTS text into a JSON request and transmits it to the default endpoint
http://172.23.252.114:8020. Although this is a private-network address, it is not a loopback address and may identify a separate host on the local network.HTTP does not provide transport confidentiality, integrity, or authenticated server identity. A network-positioned attacker could observe or modify the request. An attacker able to impersonate or control the service could also return attacker-controlled JSON, including an arbitrary
file_path. The script prints that value without validating its type or ensuring it belongs to an expected audio-output directory.Attack Path
- A user invokes the Skill with text containing confidential messages, personal information, source code, credentials, or other sensitive content.
- If
CHATTTS_API_URLis unset, the script selects the hard-coded non-loopback HTTP endpoint. - The script places the complete text ...[truncated 1170 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to a loopback endpoint, such as
http://127.0.0.1:8020, if the ChatTTS service is intended to run on the same machine. - Require HTTPS with valid certificate verification whenever the service is hosted on another machine.
- Reject non-HTTPS URLs unless the configured host is explicitly verified as loopback.
- Clearly disclose that submitted text is sent to the configured ChatTTS service and may contain sensitive data.
- Correct the Skill metadata so that it declares
CHATTTS_API_URLas the required environment variable rather than placing the endpoint URL in the environment-variable list. - Validate the response status, content type, and JSON schema before consuming it.
- Require
data.file_pathto be a string resolving beneath a dedicated, trusted audio-output directory; reject absolute or traversing paths outside that directory. - Apply authentication to the ChatTTS API where it is reachable from other hosts, and restrict network access using host firewall rules or equivalent controls.
- Default to a loopback endpoint, such as