T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/test_nano_banana_2.py:303
- Finding
- Caller-Controlled Base URL Can Exfiltrate the API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test_nano_banana_2.py:303-307, 362` **Vulnerability Type**: Unrestricted authenticated endpoint override **Risk Level**: High ### Vulnerable Code ```python parser.add_argument("--api-key", default=os.getenv("NANO_BANANA_API_KEY", "")) parser.add_argument("--check-key", action="store_true") parser.add_argument("--set-default-model", default="") parser.add_argument("--show-default-model", action="store_true") parser.add_argument("--base-url", default="https://ai.t8star.cn") ``` ```python with httpx.Client(headers=_build_headers(api_key), follow_redirects=True) as client: ``` The authorization header is constructed as follows: ```python def _build_headers(api_key: str) -> dict[str, str]: return {"Authorization": f"Bearer {api_key}"} ``` The supplied base URL is subsequently used for authenticated requests: ```python resp = client.post(f"{base_url}/v1/images/generations", json=payload, timeout=300) ``` ### Technical Analysis The documentation states that the API base address must remain fixed at `https://ai.t8star.cn`, but the implementation exposes `--base-url` without validating its scheme, hostname, port, or origin. All requests made through the client carry the global `Authorization: Bearer <API key>` header. Consequently, anyone who can influence the script invocation can replace the legitimate API endpoint with an attacker-controlled HTTPS server and receive the user's API key in the initial request. This violates the documented endpoint restriction and exceeds the minimum privileges needed for image generation. Redirect processing is also enabled globally, increasing the number of destinations the client may contact, although the direct arbitrary base URL is sufficient to exploit the issue. ### Attack Path 1. A user supplies a valid Nano Banana API key, or the script loads a previously saved key. 2. An attacker-controlled instruction causes the script to be invoked with: ```b ...[truncated 1075 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--base-url` option from production use if endpoint substitution is not required. 2. Otherwise, parse and validate the URL before creating any request: - Require the `https` scheme. - Require the exact hostname `ai.t8star.cn`. - Reject user information, fragments, alternate ports, and ambiguous host encodings. - Compare normalized origins rather than using string-prefix validation. 3. Disable automatic redirects for authenticated API requests: ```python httpx.Client(headers=_build_headers(api_key), follow_redirects=False) ``` 4. If redirects are operationally required, validate every redirect target and never forward authorization headers across origins. 5. Add tests proving that attacker-controlled domains, subdomains, alternate ports, non-HTTPS schemes, and deceptive URLs such as `ai.t8star.cn.attacker.example` are rejected. ]]>