T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imgen.js:103- Finding
Bearer Tokens and Sensitive Request Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
{ const url = new URL(urlString); const client = url.protocol === 'https:' ? https : http; const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method: 'POST', headers: { 'Content-Type': 'application/json', ...headers } }; ``` ```js const result = await httpPost(DEFAULT_API_URL, { 'Authorization': `Bearer ${token}` }, body); ``` ### Technical Analysis The API endpoint can be changed through the `IMGEN_API_URL` environment variable. The HTTP request implementation explicitly supports both HTTPS and unencrypted HTTP without requiring an additional security override or warning. When an endpoint beginning with `http://` is configured, the CLI transmits the following information without transport encryption: - The bearer API token in the `Authorization` header. - User-provided image-generation prompts. - Image-editing instructions. - Source image URLs included in editing requests. - Model and output-size parameters. Bearer tokens provide access to the associated API account to any party possessing them. Plaintext HTTP does not protect request headers or bodies from network interception or modification. The documented default endpoint uses HTTPS, so exploitation requires the endpoint to be changed to HTTP, whether intentionally, through unsafe setup instructions, or through manipulation of the process environment. ### Attack Path 1. A user or automation environment sets `IMGEN_API_URL` to an e ...[truncated 912 chars]- Remediation
View remediation