T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/qunar_query.py:71
- Finding
- Caller-Controlled API Endpoint Enables Credential Disclosure and Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/qunar_query.py:71-90` and `scripts/qunar_query.py:151-155` **Vulnerability Type**: Unrestricted authenticated outbound request / SSRF **Risk Level**: High ### Vulnerable Code ```python headers = { "Content-Type": "application/json", "Authorization": api_key } # 3. 发起请求 if method.upper() == "GET": response = requests.get( api_endpoint, headers=headers, params=api_params, timeout=30 ) else: response = requests.post( api_endpoint, headers=headers, json=api_params, timeout=30 ) ``` The destination is supplied directly through a required command-line argument: ```python parser.add_argument( "--api_endpoint", required=True, help="API端点URL（根据去哪儿网API文档填写）" ) ``` ### Technical Analysis The script loads the Qunar API key from the environment and places it in the `Authorization` header of a request sent to the caller-controlled `api_endpoint`. It does not validate the URL scheme, hostname, port, resolved IP address, or redirect destination. Consequently, a caller who can influence the endpoint can direct the authenticated request to an attacker-controlled server and capture the API key. An endpoint using plain HTTP could also expose the credential to network interception. The same primitive can be used for server-side request forgery if the execution environment permits access to internal destinations. Potential targets include loopback services, private-network hosts, link-local addresses, and cloud instance metadata endpoints. GET query parameters or POST bodies are also forwarded to the selected destination. No redirect policy is specified. If the underlying HTTP client follows redirects, an initially acceptable destination could redirect the request elsewhere. Secure handling must ensure credentials are never forwarded to an unvalidated redirect target. This behavior conflicts with the security st ...[truncated 2042 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Eliminate arbitrary endpoint input** - Define fixed API endpoints internally for each supported query type. - Do not allow users, model-generated instructions, or command-line input to select an arbitrary host. 2. **Apply an exact destination allowlist** - Require HTTPS. - Allow only explicitly approved Qunar hostnames. - Normalize and parse the URL before validation. - Reject embedded credentials, fragments, unexpected ports, malformed hostnames, and hostname suffix tricks. 3. **Prevent SSRF through address validation** - Resolve the destination and reject loopback, private, link-local, multicast, reserved, and unspecified addresses for both IPv4 and IPv6. - Protect against DNS rebinding by ensuring the validated address is the address used for the connection. - Avoid relying on hostname string checks alone. 4. **Harden redirect handling** - Prefer disabling redirects for authenticated requests. - If redirects are required, validate every redirect destination using the same scheme, hostname, port, and resolved-address rules. - Strip the `Authorization` header whenever the origin changes. 5. **Minimize credential exposure** - Add the authorization header only after the final request destination has passed validation. - Scope the credential to the narrowest supported API permissions. - Rotate the current credential if the script has previously been used with untrusted endpoints. 6. **Improve documentation and tests** - Remove instructions that tell users to supply arbitrary API endpoints. - Correct the claim that the credential cannot be disclosed to third parties. - Add security tests for attacker-controlled domains, HTTP URLs, user-info URLs, nonstandard ports, redirects, private addresses, IPv6 literals, DNS rebinding, and cloud metadata endpoints. ]]>