T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/jf_client.py:108- Finding
Unrestricted API Endpoint Allows Redirection of Sensitive Images and Authentication Metadata
- Content
View full analysis
Vulnerability Details
File Location:
scripts/jf_client.py:108-112,scripts/jf_client.py:131, andscripts/jf_client.py:176-195
Vulnerability Type: Unvalidated destination for authenticated data transmission
Risk Level: MediumVulnerable Code
python def api_call(cfg, path, body, timeout=60): url = cfg["endpoint"].rstrip("/") + path req = urllib.request.Request(url, data=json.dumps(body).encode("utf-8"), headers=auth_headers(cfg), method="POST") try: with urllib.request.urlopen(req, timeout=timeout) as r: return json.loads(r.read().decode("utf-8"))python if args.endpoint: cfg["endpoint"] = args.endpointpython def cmd_call(args): cfg = require_config() img = args.image if img.lower().startswith(("http://", "https://")): image_obj = {"url": img, "sn": args.sn} else: if not os.path.exists(img): print(json.dumps({"ok": False, "error": "image_not_found", "path": img}, ensure_ascii=False)) sys.exit(2) with open(img, "rb") as f: b64 = base64.b64encode(f.read()).decode() image_obj = {"b64": b64, "sn": args.sn} app_config = {"confThreshold": args.conf} if args.config_json: try: app_config.update(json.loads(args.config_json)) except Exception as e: print(json.dumps({"ok": False, "error": "bad_config_json", "detail": str(e)}, ensure_ascii=False)) sys.exit(2) body = {"appUuid": args.app_uuid, "image": image_obj, "appConfig": app_config} resp = api_call(cfg, "/openai/algorithm/application/v3/callApp", body, timeout=args.timeout)Technical Analysis
The client permits the configured API endpoint to be replaced with an arbitrary URL. It does not validate the URL scheme, hostname, port, embedded credentials, or final destination ...[truncated 2151 chars]
- Remediation
View remediation
Remediation Suggestions
- Allowlist the documented destination, preferably requiring the exact origin
https://api.jftechws.com. - Parse the endpoint with a standard URL parser and reject:
- Schemes other than HTTPS.
- Embedded usernames or passwords.
- Unexpected ports.
- Missing or unexpected hostnames.
- Fragments and malformed paths.
- Disable redirects or verify that every redirect remains on the approved HTTPS origin.
- If custom enterprise endpoints are genuinely required, maintain an explicit administrator-controlled allowlist rather than accepting arbitrary command-line values.
- Display the destination hostname and require explicit user confirmation immediately before uploading an image to any non-default endpoint.
- Bind signatures to the HTTP method, destination host, path, and body where supported by the API protocol.
- Add automated tests proving that HTTP URLs, lookalike domains, alternate ports, embedded credentials, and cross-origin redirects are rejected.
- Allowlist the documented destination, preferably requiring the exact origin