T09 · Insecure Skill Coding Practices
Error
- Location
assets/OpenClawUnrealPlugin/Source/OpenClawUnreal/Private/OpenClawSubsystem.cpp:9- Finding
Bearer Token Disclosure Through an Unrestricted HTTP Endpoint
- Content
View full analysis
Request = FHttpModule::Get().CreateRequest(); Request->SetURL(Url); Request->SetVerb(TEXT("POST")); Request->SetHeader(TEXT("Content-Type"), TEXT("application/json")); if (!ApiKey.IsEmpty()) { Request->SetHeader(TEXT("Authorization"), FString::Printf(TEXT("Bearer %s"), *ApiKey)); } ``` ### Technical Analysis The Blueprint-callable configuration accepts an arbitrary base URL and retains an API key without validating the URL scheme, hostname, port, or destination trust boundary. The request subsequently attaches that key as a bearer credential. The implementation does not require HTTPS, reject embedded URL credentials, or enforce an administrator-controlled host allowlist. The use of plaintext HTTP is also demonstrated in `references/sample-blueprint-flow.md:60`: ```text URL: http:///api/unreal/task ``` Consequently, a caller that can influence Blueprint configuration can direct authenticated requests to an attacker-controlled server. If HTTP is used, an on-path attacker can also observe or alter the authorization header, task body, and response. ### Attack Path 1. An attacker gains influence over the values supplied to the Blueprint-callable `Configure()` function, such as through an untrusted configuration value or modifiable Blueprint. 2. The attacker supplies an endpoint such as `http://attacker-controlled.example`. 3. A val ...[truncated 791 chars]- Remediation
View remediation