T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:31
- Finding
- Azure API Key Disclosure Through an Untrusted or Plaintext Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–43 **Vulnerability Type**: Insufficient endpoint validation causing credential disclosure **Risk Level**: High ### Vulnerable Code ```bash # Basic validation (reject obviously malformed endpoints) if ! printf '%s' "${FOUNDRY_ENDPOINT:-}" | grep -Eq '^https?://[A-Za-z0-9._:-]+/?$'; then echo "FOUNDRY_ENDPOINT looks unsafe or is not set" >&2 exit 1 fi url="${FOUNDRY_ENDPOINT%/}/openai/deployments/${FOUNDRY_DEPLOYMENT}/images/generations?api-version=${FOUNDRY_API_VERSION:-2025-04-01-preview}" PROMPT="a red fox" jq -n --arg prompt "$PROMPT" '{prompt:$prompt, n:1, size:"1024x1024", output_format:"png"}' | \ curl --fail --show-error --silent \ --url "$url" \ -H 'Content-Type: application/json' \ -H "api-key: ${FOUNDRY_API_KEY}" \ ``` ### Technical Analysis The endpoint validation only verifies that the value resembles an HTTP or HTTPS URL with a syntactically simple hostname. It explicitly permits plaintext HTTP and does not restrict the hostname to an approved Azure Foundry service or another administrator-approved destination. The subsequent `curl` request sends the primary Azure credential in the `api-key` header. It also sends the image-generation prompt in the request body. Consequently, anyone able to influence `FOUNDRY_ENDPOINT` can direct both sensitive values to an arbitrary server that passes the weak regular expression. When HTTP is used, the API key and prompt are transmitted without TLS protection and can also be observed or modified by a network-positioned attacker. ### Attack Path 1. An attacker influences the environment or configuration used to set `FOUNDRY_ENDPOINT`. 2. The attacker sets it to a server under their control, such as `https://attacker.example`, or to a plaintext HTTP endpoint. 3. The value passes the regular expression because arbitrary hostnames and both URL schemes are accepted. 4. The skill constructs the image-generation URL bene ...[truncated 827 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require `https://` and reject plaintext HTTP endpoints. - Parse the URL with a proper URL parser rather than relying solely on a regular expression. - Restrict the hostname to an explicit allowlist of approved Azure service domains or administrator-configured endpoint names. - Reject unexpected ports, user-information components, fragments, and malformed hostnames. - Prevent requests from automatically following redirects to unapproved hosts if redirect support is added later. - Use a minimally privileged, deployment-specific credential and rotate any credential that may have been exposed. - Prefer short-lived Azure identity tokens or managed identity authentication where supported. - Avoid logging request headers, environment variables, or command traces containing the API key. - Validate that the resolved destination does not unexpectedly point to loopback, link-local, or private infrastructure when arbitrary custom endpoints are not required. ]]>