T09 · Insecure Skill Coding Practices
- Location
ollama_ocr.py:8- Finding
Image Data Transmitted over Plaintext HTTP to a Hard-Coded Network Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
ollama_ocr.py, lines 8–38
Vulnerability Type: Plaintext transmission of potentially sensitive image data to a hard-coded network address
Risk Level: MediumVulnerable Code:
python OLLAMA_HOST = "172.17.0.2" OLLAMA_PORT = "11434" DEFAULT_MODEL = "glm-ocr:latest" def ollama_ocr(image_path, model=DEFAULT_MODEL): """Call Ollama API for image text recognition""" try: # Read and encode image with open(image_path, 'rb') as f: img_b64 = base64.b64encode(f.read()).decode() # Prepare request data = json.dumps({ 'model': model, 'messages': [{ 'role': 'user', 'content': 'Extract all text from this image', 'images': [img_b64] }] }).encode() url = f"http://{OLLAMA_HOST}:{OLLAMA_PORT}/api/chat" req = urllib.request.Request( url, data=data, headers={'Content-Type': 'application/json'} ) # Get response resp = urllib.request.urlopen(req, timeout=120)Technical Analysis
The function reads the complete contents of a user-selected image, Base64-encodes them, and transmits them to the fixed address
172.17.0.2:11434using unencrypted HTTP. Base64 only changes the data representation and does not provide confidentiality.The address is intended to represent an Ollama service reachable through a Docker network. However, private IP ownership is environment-dependent and can change when containers or networks are recreated. If an untrusted container or service obtains this address, it can receive the entire image. An attacker with visibility into the relevant host or container network could also observe the plaintext request.
No authentication or server identity verification is performe ...[truncated 1485 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the hard-coded destination with an explicit, validated configuration value, such as an environment variable or protected configuration file.
- Default to a loopback endpoint such as
127.0.0.1when Ollama runs in the same security boundary. Consider a Unix-domain socket where supported. - Use HTTPS with certificate validation when image data must cross a network boundary. Do not disable TLS certificate or hostname verification.
- Authenticate the Ollama endpoint or place it behind an authenticated local proxy so that the client can verify the intended recipient.
- Apply an allowlist for acceptable schemes, hosts, and ports. Reject plaintext remote endpoints unless the user explicitly enables them after receiving a security warning.
- Inform users that the complete image is transmitted to the configured service and obtain explicit confirmation before processing sensitive images through a non-loopback endpoint.
- Pin or otherwise control the Docker service identity instead of relying solely on a potentially reassigned container IP address.
- Update
SKILL.mdto clarify that “offline” does not inherently mean that image data remains within the current process and that plaintext container-network transmission may still be observable.