T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ensemble.py:118- Finding
Arbitrary Ollama Endpoint Can Receive Confidential Task Data
- Content
View full analysis
str: parsed = urlparse(host) if parsed.scheme not in ("http", "https"): raise ValueError( f"OLLAMA_HOST must use http:// or https://, got: {host!r}" ) if not parsed.netloc: raise ValueError(f"OLLAMA_HOST has no hostname: {host!r}") return host.rstrip("/") ``` ```python ollama_host = os.environ.get("OLLAMA_HOST", "") ollama_ok = False if ollama_host: try: validate_ollama_host(ollama_host) ollama_ok = True ``` ```python async def query_ollama(model: str, prompt: str) -> str: host = validate_ollama_host( os.environ.get("OLLAMA_HOST", "http://localhost:11434") ) client = _get_httpx() r = await client.post( f"{host}/api/generate", json={"model": model, "prompt": prompt, "stream": False}, ) r.raise_for_status() return r.json()["response"] ``` ### Technical Analysis `validate_ollama_host()` verifies only that the URL uses HTTP or HTTPS and contains a network location. It does not restrict the destination to localhost, require explicit approval for a remote host, require TLS for remote connections, or prevent connections to attacker-controlled and infrastructure-sensitive addresses. When `OLLAMA_HOST` is present and passes this minimal validation, the endpoint is treated as an available provider. The script first queries its `/api/tags` endpoint and can then transmit the complete task prompt to `/api/generate`. This creates both a confidentiality risk and a trust-boundary violation. Plain HTTP is accepted, so prompts may also be exposed to interception or modification in transit. ### Attack Path 1. An attacker influences the environment or configurati ...[truncated 1216 chars]- Remediation
View remediation