T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/imou_client.py:33
- Finding
- Unrestricted API Base URL Can Expose Authentication Material and Administrative Device Tokens<![CDATA[ ## Vulnerability Details **File Location**: `scripts/imou_client.py:33-74` **Vulnerability Type**: Unvalidated security-sensitive network destination **Risk Level**: High ### Vulnerable Code ```python def _get_base_url(): return os.environ.get("IMOU_BASE_URL", "").strip() or DEFAULT_BASE_URL def _build_sign(time_sec: int, nonce: str, app_secret: str) -> str: """Build sign: MD5 of 'time:{time},nonce:{nonce},appSecret:{app_secret}' (UTF-8), 32-char lowercase hex.""" raw = f"time:{time_sec},nonce:{nonce},appSecret:{app_secret}" return hashlib.md5(raw.encode("utf-8")).hexdigest() def _request(method: str, params: dict, app_id: str, app_secret: str, base_url: str = None) -> dict: """ Send one Open API request. :param method: API method name (e.g. 'accessToken', 'setDeviceSnapEnhanced', 'controlMovePTZ'). :param params: Request params object. :param app_id: App ID. :param app_secret: App secret for sign. :param base_url: Optional base URL; uses env IMOU_BASE_URL or default if None. :return: Full response body as dict; check result.code for '0'. """ base = base_url or _get_base_url() url = f"{base.rstrip('/')}/openapi/{method}" time_sec = int(time.time()) nonce = uuid.uuid4().hex sign = _build_sign(time_sec, nonce, app_secret) body = { "system": { "ver": "1.0", "appId": app_id, "sign": sign, "time": time_sec, "nonce": nonce, }, "id": str(uuid.uuid4()), "params": params, } headers = { "Content-Type": "application/json", OPENCLAW_HEADER: OPENCLAW_HEADER_VALUE, } resp = requests.post(url, headers=headers, json=body, timeout=30) resp.raise_for_status() return resp.json() ``` The affected requests subsequently include administrative tokens and device identifiers: ```python out = _request( "setDeviceSnapEnhanced", { "token": token, ...[truncated 2833 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the configured URL with a standards-compliant URL parser before constructing requests. 2. Require the `https` scheme and reject plaintext HTTP. 3. Allowlist only the documented API hostnames: - `openapi.lechange.cn` - `openapi-sg.easy4ip.com` - `openapi-fk.easy4ip.com` - `openapi-or.easy4ip.com` 4. Reject embedded credentials, fragments, unexpected query strings, IP-literal hosts, and ports other than the explicitly supported HTTPS port. 5. Disable redirects for API POST requests, or validate every redirect destination before following it. 6. If custom endpoints are operationally necessary, require an explicit unsafe-development option rather than trusting an ordinary environment variable. 7. Document accurately that the application secret is used locally to generate a signature, while the application ID, signature, access token, and device metadata are transmitted. 8. Assign the Imou application only the minimum server-side device permissions required for snapshots and PTZ control. 9. Revoke and rotate affected tokens and credentials if requests may have been sent to an untrusted endpoint. ]]>