T09 · Insecure Skill Coding Practices
- Location
scripts/ns-api.mjs:28- Finding
NS Subscription Key May Be Disclosed Across HTTP Redirects
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ns-api.mjs, lines 28–39
Vulnerability Type: Credential exposure through unvalidated redirects
Risk Level: Mediumjs export async function nsFetch(url, { subscriptionKey, headers = {}, ...opts } = {}) { const u = assertAllowlistedUrl(url); const res = await fetch(u, { ...opts, headers: { 'Ocp-Apim-Subscription-Key': subscriptionKey, 'Accept': 'application/json', ...headers, }, }); return res; }Technical Analysis
assertAllowlistedUrl()validates only the initial request URL. It requires HTTPS and restricts the hostname togateway.apiportal.ns.nl. However,fetch()follows HTTP redirects by default, and the redirect destination is not passed through the URL validation function.The request includes the sensitive
Ocp-Apim-Subscription-Keycustom header. Unlike certain standard credential headers that implementations may remove during cross-origin redirects, this custom header cannot safely be assumed to be stripped. Therefore, a redirect to another origin may cause the subscription key to be transmitted outside the documented host allowlist.This behavior also makes the guarantee in
SECURITY.md—that only the NS API gateway receives requests—stronger than the protection actually enforced by the implementation.Attack Path
- A legitimate script invokes
nsFetch()with the user's NS subscription key. - The allowlisted NS gateway, or an endpoint under that gateway, returns an HTTP redirect.
- Exploitation requires the trusted gateway or its response path to be compromised, maliciously configured, or otherwise capable of redirecting to an attacker-controlled HTTPS origin.
- Because redirect handling remains at the default
followsetting,fetch()follows the redirect without invokingassertAllowlistedUrl()again. - The custom
Ocp-Apim-Subscription-Keyheader may be forwarde ...[truncated 647 chars]
- A legitimate script invokes
- Remediation
View remediation
Remediation Suggestions
- Set
redirect: 'manual'in the initialfetch()request and reject redirects unless they are explicitly required. - If redirects must be supported, resolve each
Locationheader against the current URL and validate every destination with the same HTTPS and exact-host allowlist before making another request. - Never forward
Ocp-Apim-Subscription-Keywhen the redirect changes the origin. - Impose a small redirect limit to prevent loops and redirect-based resource exhaustion.
- Prevent callers from overriding the redirect policy through
opts; apply the security-controlled option after spreading caller options. - Add automated tests covering redirects to non-allowlisted hosts, non-HTTPS destinations, malformed locations, redirect loops, and same-host redirects.
- Update
SECURITY.mdso its egress guarantee precisely reflects the implemented redirect policy.
- Set