T09 · Insecure Skill Coding Practices
- Location
memos.py:9- Finding
Bearer Token May Be Transmitted to an Untrusted or Plaintext Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
memos.py, lines 9–20 and 43–52
Vulnerability Type: Unrestricted credential transmission
Risk Level: MediumVulnerable Code
python BASE_URL = os.getenv("MEMOS_URL") TOKEN = os.getenv("MEMOS_TOKEN") if not BASE_URL: raise RuntimeError("MEMOS_URL environment variable is not set.") if not TOKEN: raise RuntimeError("MEMOS_TOKEN environment variable is not set.") HEADERS = { "Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json", }python url = f"{BASE_URL}{endpoint}" try: resp = requests.request( method, url, headers=HEADERS, json=data, params=params, timeout=30 # 30 second timeout )Technical Analysis
The user-controlled
MEMOS_URLenvironment variable is used as the request destination without validating its scheme, host, embedded credentials, or trust boundary. Every API request includes theMEMOS_TOKENin anAuthorization: Bearerheader.If
MEMOS_URLuses plain HTTP, the bearer token and memo data can traverse the network without transport encryption. If the variable is accidentally or maliciously set to an attacker-controlled server, invoking any supported command sends the token directly to that server.This behavior is not concealed data exfiltration because the destination is explicitly configured by the environment. Nevertheless, failing to enforce secure transport and destination constraints creates an exploitable credential-handling weakness.
Redirect behavior should also be treated carefully. Even where the initial URL is trusted, authentication must not be forwarded to an unvalidated redirect destination.
Attack Path
- An attacker with influence over process configuration, deployment variables, a wrapper script, or setup instructions changes
MEMOS_URLto an attacker-controlled URL or a plaintext ` ...[truncated 1060 chars]
- An attacker with influence over process configuration, deployment variables, a wrapper script, or setup instructions changes
- Remediation
View remediation
Remediation Suggestions
- Parse
MEMOS_URLwithurllib.parse.urlparserather than using unchecked string concatenation. - Require the
httpsscheme for non-loopback destinations. - Reject malformed URLs, embedded username/password components, fragments, and unexpected schemes.
- If local plaintext deployments are required, permit HTTP only through an explicit opt-in and only for verified loopback hosts such as
127.0.0.1,::1, orlocalhost. - Normalize the base URL and construct API URLs with a safe URL-joining strategy.
- Disable redirects for authenticated requests unless required. If redirects are supported, validate every redirect target and do not forward the authorization header across origin boundaries.
- Use a narrowly scoped Memos token and provide rotation guidance in case configuration is compromised.
- Add tests confirming rejection of HTTP remote URLs, non-HTTP schemes, embedded credentials, malformed hosts, and cross-origin redirects.
Example validation approach:
python from urllib.parse import urlparse parsed = urlparse(BASE_URL) if parsed.scheme != "https": raise RuntimeError("MEMOS_URL must use HTTPS.") if not parsed.hostname or parsed.username or parsed.password: raise RuntimeError("MEMOS_URL is invalid.")- Parse