T09 · Insecure Skill Coding Practices
Error
- Location
scripts/jira.sh:46- Finding
Jira credentials can be forwarded to an untrusted pagination URL
- Content
View full analysis
"$out_file" local next="${JIRA_URL}/rest/api/3/worklog/updated?since=${since_ms}" while [[ -n "$next" ]]; do local resp resp=$(api GET "$next") echo "$resp" | jq -r '.values[].worklogId' >>"$out_file" local last last=$(echo "$resp" | jq -r '.lastPage') if [[ "$last" == "true" ]]; then next="" else next=$(echo "$resp" | jq -r '.nextPage // ""') fi done } ``` ### Technical Analysis The `api()` function treats any string beginning with `http` as an acceptable absolute URL. It then unconditionally attaches the Jira Basic authorization header, which contains the Base64-encoded Jira email address and API token. The `fetch_worklog_ids()` function obtains subsequent request URLs from the server-provided `nextPage` property. No validation ensures that this URL: - Uses HTTPS. - Has the same host and port as `JIRA_URL`. - Is an expected Jira REST API path. - Does not contain a redirect or reference an external origin. Consequently, a malicious or compromised Jira-compatible endpoint can direct the client to an attacker-controlled server while retaining the authorization header. The configuration also accepts an HTTP `JIRA_URL`, allowing credentials and Jira information to be transmitted without transport encryption. ### Attack Path 1. A user invokes `hours` or `hours-day`, causing `fetch ...[truncated 1384 chars]- Remediation
View remediation
&2 return 1 fi if [[ "$path" == http://* || "$path" == https://* || "$path" == //* ]]; then echo "Error: API requests must use relative Jira paths" >&2 return 1 fi curl --proto '=https' -sS -X "$method" "${JIRA_URL}${path}" \ -H "$AUTH_HEADER" \ -H "$JSON_HEADER" \ ${data:+-d "$data"} } ``` Pagination values should additionally be parsed and converted to relative paths only after verifying that their origin exactly matches `JIRA_URL`. ]]>