T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sufn-helpers.ps1:64
- Finding
- Bearer Token Disclosure Through Unvalidated API Path Construction## Vulnerability Details **File Location**: `scripts/sufn-helpers.ps1`, lines 64–96 **Vulnerability Type**: Unvalidated URI construction and credential disclosure **Risk Level**: High ### Vulnerable Code ```powershell function Invoke-SufnPlatform { param( [Parameter(Mandatory = $true)][string]$Path, [Parameter(Mandatory = $true)]$Body, [string]$AuthToken, [string]$Method = 'POST' ) # TLS 1.2+（函数级别保障，即使模块级设置被覆盖） [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $params = @{ Method = $Method Uri = "https://open.aibasis.cc$Path" ContentType = 'application/json' ErrorAction = 'Stop' } if ($Method -eq 'POST' -and $Body) { $params.Body = ($Body | ConvertTo-Json -Depth 12 -Compress) } if ($AuthToken) { $params.Headers = @{ Authorization = "Bearer $AuthToken" } } try { $response = Invoke-RestMethod @params # 检查业务层返回码 if ($response.PSObject.Properties.Name -contains 'code' -and $response.code -ne 0) { return $null } return $response } catch { return $null } } ``` ### Technical Analysis `Invoke-SufnPlatform` directly appends the caller-controlled `$Path` value to the trusted base-address string. It does not require a leading slash, reject URI authority delimiters, validate the resulting host, or enforce the documented endpoint allowlist. A crafted value such as `@attacker.example/` results in: ```text https://open.aibasis.cc@attacker.example/ ``` Under standard URI parsing, `open.aibasis.cc` becomes user-information and the effective destination host is `attacker.example`. Because the helper independently adds `Authorization: Bearer <token>` whenever `$AuthToken` is present, the credential can be sent to the attacker-controlled HTTPS en ...[truncated 1487 chars]
- Remediation
- ## Remediation Suggestions 1. Enforce an exact method-and-path allowlist in `Invoke-SufnPlatform`, covering only the five documented endpoints. 2. Require paths to begin with exactly one `/` and reject values containing a URI scheme, backslashes, control characters, `@`, fragments, or an authority component. 3. Construct requests with `System.UriBuilder` or resolve a validated relative URI against a fixed base `System.Uri`; do not use raw string concatenation. 4. Before attaching the bearer token, verify that the final URI: - Uses the `https` scheme. - Has the exact host `open.aibasis.cc`. - Uses the expected port. - Contains no user-information. - Has an allowlisted absolute path. 5. Validate `$Method` against the method required for each endpoint rather than accepting an arbitrary string. 6. Disable automatic redirects where supported, or validate every redirect destination and never forward authorization credentials to another origin. 7. Add negative tests for paths such as `@attacker.example/`, `//attacker.example/`, absolute URLs, encoded delimiters, backslashes, and unexpected endpoints.