T09 · Insecure Skill Coding Practices
- Location
scripts/flux.sh:3- Finding
Unrestricted API Endpoint Can Expose Bearer Credentials over Untrusted or Plaintext Connections
- Content
View full analysis
Vulnerability Details
File Location:
scripts/flux.sh:3-24,scripts/flux.sh:145-148
Vulnerability Type: Unrestricted credential transmission to a caller-controlled endpoint
Risk Level: MediumVulnerable Code
bash FLUX_URL="${FLUX_URL:-https://api.flux-universe.com}" FLUX_TOKEN="${FLUX_TOKEN:-}" FLUX_ADMIN_TOKEN="${FLUX_ADMIN_TOKEN:-}" # Helper function for API calls api_call() { local method=$1 local endpoint=$2 local data=$3 local auth_header="" if [[ -n "$FLUX_TOKEN" ]]; then auth_header="-H \"Authorization: Bearer ${FLUX_TOKEN}\"" fi local -a cmd=(curl -s -X "$method" "${FLUX_URL}${endpoint}" -H "Content-Type: application/json") if [[ -n "$FLUX_TOKEN" ]]; then cmd+=(-H "Authorization: Bearer ${FLUX_TOKEN}") fi if [[ -n "$data" ]]; then cmd+=(-d "$data") fi "${cmd[@]}" }The administrative request has the same endpoint-trust issue:
bash curl -s -X PUT "${FLUX_URL}/api/admin/config" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${FLUX_ADMIN_TOKEN}" \ -d "$2" | format_outputTechnical Analysis
FLUX_URLis accepted directly from the process environment and used as the destination for authenticatedcurlrequests. The script does not validate the URL scheme, hostname, port, embedded user information, or whether the destination is an approved Flux deployment.Consequently, both
FLUX_TOKENand the more privilegedFLUX_ADMIN_TOKENcan be transmitted to an arbitrary destination selected throughFLUX_URL. The project documentation explicitly supports HTTP for local deployments, but the implementation does not restrict plaintext HTTP to loopback addresses. A value such ashttp://attacker.examplewould therefore cause the script to send bearer credentials and request data without transport encryption to that server.This issue req ...[truncated 2127 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse and validate
FLUX_URLbefore making any request. Permit onlyhttps://for remote hosts. - Allow plaintext
http://only for explicitly recognized loopback destinations such aslocalhost,127.0.0.1, and[::1]. - Reject unsupported schemes, embedded credentials, malformed URLs, and unexpected URL components.
- Consider an allowlist of trusted Flux hostnames, especially before transmitting
FLUX_ADMIN_TOKEN. - Require a deliberate opt-in such as
FLUX_ALLOW_INSECURE_LOCAL_HTTP=1for development-only plaintext connections, and emit a prominent warning. - Separate administrative endpoint configuration from ordinary API configuration so changing the normal endpoint cannot silently redirect an administrative credential.
- Avoid sending any authorization header until endpoint validation succeeds.
- Configure short-lived, narrowly scoped tokens and provide a documented revocation and rotation process for credentials that may have been exposed.
- Add automated tests confirming that remote HTTP URLs, non-HTTP schemes, embedded URL credentials, and unapproved hosts are rejected.
- Parse and validate