T09 · Insecure Skill Coding Practices
Error
- Location
scripts/login.sh:7- Finding
Unvalidated Gateway URL Permits Credential Transmission over Plaintext or to an Untrusted Host
- Content
View full analysis
&2 exit 1 fi # Extract subdomain from a gateway URL like https://demo.next.erxes.io/gateway -> demo SUB=$(echo "$BASE" | sed -E 's|https?://([^./]+).*|\1|') RESP=$(curl -sf -X POST "$BASE/oauth/device/code" \ -H "Content-Type: application/json" \ -H "erxes-subdomain: $SUB" \ -d "{\"client_id\":\"$CLIENT\"}") ``` ```bash TOK=$(curl -s -X POST "$BASE/oauth/token" \ -H "Content-Type: application/json" \ -H "erxes-subdomain: $SUB" \ -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:device_code\",\"device_code\":\"$DC\",\"client_id\":\"$CLIENT\"}") ``` The corresponding instructions explicitly permit an HTTP endpoint: ```bash ERXES_BASE_URL=http://localhost:4000 ERXES_CLIENT_ID=my-client bash scripts/login.sh ``` ### Technical Analysis The login helper verifies only that `ERXES_BASE_URL` is nonempty. It does not securely parse or validate the URL's scheme, hostname, port, user-information component, or destination class. Consequently, the OAuth device code and token requests may be sent over plaintext HTTP or to an attacker-controlled server. The Skill subsequently instructs the Agent to use the returned bearer token and subdomain for authenticated GraphQL requests. This behavior is necessary when communicating with a legitimate erxes gateway, but accepting arbitrary endpoints and plaintext transport exceeds the minimum safe privileges needed for that functionality. Shell quoting prevents direct shell metacharacter expansion in `BASE`, but it does not prevent server impersonation, TLS downgrade, DNS manipulation, or credential transmission to an untrusted origin. ### Attack Path 1. An attacker ...[truncated 1080 chars]- Remediation
View remediation