T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/publish_note.py:152- Finding
Local image uploads can be sent to an unvalidated server-provided endpoint
- Content
View full analysis
{endpoint}") _multipart_upload(endpoint, form, file_path) ``` The endpoint is then used directly as the destination of the multipart request: ```python upload_url = endpoint.rstrip("/") + "/" req = Request( upload_url, data=body, headers={"Content-Type": f"multipart/form-data; boundary={boundary}"}, method="POST", ) ``` ### Technical Analysis The local-image upload workflow obtains a dynamically supplied `endpoint` from the Mowen upload-prepare API and trusts it without validating its URL scheme, hostname, port, or redirect behavior. Using a dynamic object-storage endpoint is necessary for the declared image-upload functionality. However, the implementation does not constrain that destination to Mowen-approved Alibaba OSS infrastructure. It consequently gives the remote prepare response control over where a user-selected local image and temporary signed upload fields are transmitted. The uploaded multipart body includes: - The complete contents of the selected local image. - The OSS policy and callback fields. - Temporary OSS credential and signature fields. - File and user identifiers returned by the prepare API. The long-lived `MOWEN_API_KEY` is not sent to the dynamic endpoint. It remains in the authenticated request to the fixed `https://open.mowen.cn` origin. ### Attack Path 1. A user asks the Skill to create or edit a note containing a local image. 2. The script reads th ...[truncated 1379 chars]- Remediation
View remediation