T09 · Insecure Skill Coding Practices
- Location
scripts/tts.py:47- Finding
Unrestricted API Endpoint Allows Disclosure of Credentials and User Text
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tts.py, lines 47-106
Vulnerability Type: User-controlled credential transmission endpoint
Risk Level: HighThe script permits callers to override the MiniMax API endpoint without validating its scheme, hostname, port, or path. It then sends the MiniMax bearer token and user-provided synthesis text directly to that endpoint.
python p.add_argument("--api_url", default=DEFAULT_API_URL, help=f"API URL (default: {DEFAULT_API_URL})")python def synthesize(args): api_key = get_api_key(args.api_key) payload = build_payload(args) headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } print(f"[MiniMax TTS] Model: {args.model} | Voice: {args.voice_id} | Format: {args.audio_format} | Sample Rate: {args.sample_rate}") print(f"[MiniMax TTS] Text ({len(args.text)} chars): {args.text[:80]}{'...' if len(args.text) > 80 else ''}") resp = requests.post(args.api_url, headers=headers, json=payload, timeout=60)The unsafe override is also explicitly documented in
skill.md, line 92:text --api_url URL Override API URLTechnical Analysis
args.api_urlis entirely caller-controlled. No allowlist limits requests to the documented MiniMax endpoints, and no validation requires HTTPS. The value is passed directly torequests.post()while the request contains:- The MiniMax API key in the
Authorization: Bearerheader. - The complete user-supplied text in the JSON payload.
- Other synthesis configuration and metadata.
Consequently, a malicious or mistakenly supplied endpoint can collect both the credential and potentially sensitive input text. Non-HTTPS URLs can additionally expose this information to network interception. Internal or loopback destinations could also cause the execution environment to make authenticated outbound requests to unint ...[truncated 1422 chars]
- The MiniMax API key in the
- Remediation
View remediation
Remediation Suggestions
- Remove
--api_urlif endpoint customization is not essential. - If both documented endpoints must be supported, accept an endpoint identifier rather than an arbitrary URL and map it internally to:
https://api.minimax.io/v1/t2a_v2https://api-uw.minimax.io/v1/t2a_v2
- If URL input must remain available, parse and normalize it before use and enforce all of the following:
- The scheme must be
https. - The hostname must exactly match an approved MiniMax hostname.
- User information, fragments, unexpected ports, and alternate paths must be rejected.
- Hostname suffix matching must not be used because domains such as
api.minimax.io.attacker.examplecould bypass an unsafe suffix check.
- The scheme must be
- Disable redirects for authenticated requests with
allow_redirects=False, or validate every redirect destination before resending any sensitive header. - Never attach the MiniMax authorization header when the destination fails validation.
- Add automated tests covering HTTP URLs, loopback and private addresses, deceptive hostnames, URL user-information syntax, alternate ports, and redirects to untrusted hosts.
- Remove