T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/baidu_search/main.py:45- Finding
Unauthenticated Public Search Endpoint Can Consume the Operator's Baidu API Credentials
- Content
View full analysis
SearchResponse: """ 搜索网页 - **query**: 搜索关键词 - **top_k**: 返回结果数量 (1-20, 默认 10) - **recency_filter**: 时间过滤 (day, week, month, year) - **site_filter**: 限定搜索的网站列表 """ return search(request) if __name__ == "__main__": import uvicorn uvicorn.run("baidu_search.main:app", host="0.0.0.0", port=8001) ``` The endpoint ultimately retrieves and uses the operator's credential: ```python def search(request: SearchRequest) -> SearchResponse: """执行百度搜索""" api_key = _get_api_key() headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}" } ``` ### Technical Analysis The `/search` route has no authentication or authorization control. When the module is executed directly, Uvicorn listens on `0.0.0.0`, making the application reachable through every available network interface unless an external firewall prevents access. Every accepted request invokes `search()`, which reads the operator-controlled `BAIDU_API_KEY` and uses it to authenticate a request to the Baidu Qianfan service. Consequently, any network client that can reach the service can indirectly exercise the operator's upstream credential without possessing it. This behavior also conflicts with the local-only startup example in `SKILL.md`, which binds the documented service to `127.0.0.1`. The direct Python execution path silently provides a broader exposure boundary. The absence of request rate limiting, caller quotas, or practical maximum lengths for `query` and `site_filter` further increases the potential for resource and upstream quota abuse. ### Attack Path 1. The operator start ...[truncated 1272 chars]- Remediation
View remediation