T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ecovacs.py:58
- Finding
- Unrestricted Gateway Override Can Disclose the Access Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ecovacs.py`, lines 58–114 **Vulnerability Type**: Unvalidated sensitive-data transmission destination **Risk Level**: High ### Vulnerable Code ```python def portal_base(): return os.environ.get("ECOVACS_PORTAL_URL", "https://open.ecovacs.cn").rstrip("/") def http_get_json(url): req = urlreq.Request(url, headers={"Accept": "application/json"}) with urlreq.urlopen(req, timeout=45) as resp: return json.loads(resp.read().decode("utf-8")) def http_post_json(url, body): data = json.dumps(body).encode("utf-8") req = urlreq.Request( url, data=data, headers={"Content-Type": "application/json", "Accept": "application/json"}, ) with urlreq.urlopen(req, timeout=45) as resp: return json.loads(resp.read().decode("utf-8")) def skill_device_list(ak): q = urlparse.quote(ak, safe="") url = f"{portal_base()}/robot/skill/deviceList?ak={q}" return http_get_json(url) def skill_pet_cmd(ak, nick_name, cmd, body_data=None): """宠物控机请求。""" url = f"{portal_base()}/robot/skill/pet/cmd" body = {"ak": ak, "nickName": nick_name, "cmd": cmd} if body_data is not None: body["data"] = body_data return http_post_json(url, body) ``` ### Technical Analysis The `ECOVACS_PORTAL_URL` environment variable completely controls the destination to which the script sends the Ecovacs Open Platform Access Key. The value is not validated for an approved hostname or an HTTPS scheme. For device discovery, the AK is included in the URL query string. Query parameters can be recorded by HTTP servers, reverse proxies, observability systems, and URL logs. For control requests, the AK is transmitted in the JSON body together with the device nickname, command name, and command data. Sending the AK to the official Ecovacs gateway is necessary for the declared device-control functionality. However, permitting any environment-selected host, ...[truncated 1479 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Allow only the documented HTTPS gateway origins by default: - `https://open.ecovacs.cn` - `https://open.ecovacs.com` 2. Parse the configured URL and reject: - Schemes other than `https`. - Embedded credentials. - Unexpected ports. - Hosts outside an administrator-controlled allowlist. - Ambiguous or malformed hostnames. 3. If private gateways are a legitimate requirement, require explicit administrative opt-in rather than trusting an unrestricted environment variable. 4. Change device discovery to use the supported POST form with `{"ak": "<AK>"}` so the credential is not placed in the URL query string. 5. Avoid logging complete request URLs, request bodies, or responses that may contain authentication material. 6. Document the trust boundary and warn users that custom gateways receive the AK and device command data. ]]>