T09 · Insecure Skill Coding Practices
- Location
scripts/sufn-helpers.ps1:64- Finding
Bearer Token Disclosure Through Unvalidated API Path Construction
- Content
View full analysis
Vulnerability Details
File Location:
scripts/sufn-helpers.ps1, lines 64–96
Vulnerability Type: Unvalidated URI construction and credential disclosure
Risk Level: HighVulnerable Code
powershell function Invoke-SufnPlatform { param( [Parameter(Mandatory = $true)][string]$Path, [Parameter(Mandatory = $true)]$Body, [string]$AuthToken, [string]$Method = 'POST' ) # TLS 1.2+（函数级别保障，即使模块级设置被覆盖） [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $params = @{ Method = $Method Uri = "https://open.aibasis.cc$Path" ContentType = 'application/json' ErrorAction = 'Stop' } if ($Method -eq 'POST' -and $Body) { $params.Body = ($Body | ConvertTo-Json -Depth 12 -Compress) } if ($AuthToken) { $params.Headers = @{ Authorization = "Bearer $AuthToken" } } try { $response = Invoke-RestMethod @params # 检查业务层返回码 if ($response.PSObject.Properties.Name -contains 'code' -and $response.code -ne 0) { return $null } return $response } catch { return $null } }Technical Analysis
Invoke-SufnPlatformdirectly appends the caller-controlled$Pathvalue to the trusted base-address string. It does not require a leading slash, reject URI authority delimiters, validate the resulting host, or enforce the documented endpoint allowlist.A crafted value such as
@attacker.example/results in:text https://open.aibasis.cc@attacker.example/Under standard URI parsing,
open.aibasis.ccbecomes user-information and the effective destination host isattacker.example. Because the helper independently addsAuthorization: Bearer <token>whenever$AuthTokenis present, the credential can be sent to the attacker-controlled HTTPS en ...[truncated 1487 chars]- Remediation
View remediation
Remediation Suggestions
- Enforce an exact method-and-path allowlist in
Invoke-SufnPlatform, covering only the five documented endpoints. - Require paths to begin with exactly one
/and reject values containing a URI scheme, backslashes, control characters,@, fragments, or an authority component. - Construct requests with
System.UriBuilderor resolve a validated relative URI against a fixed baseSystem.Uri; do not use raw string concatenation. - Before attaching the bearer token, verify that the final URI:
- Uses the
httpsscheme. - Has the exact host
open.aibasis.cc. - Uses the expected port.
- Contains no user-information.
- Has an allowlisted absolute path.
- Uses the
- Validate
$Methodagainst the method required for each endpoint rather than accepting an arbitrary string. - Disable automatic redirects where supported, or validate every redirect destination and never forward authorization credentials to another origin.
- Add negative tests for paths such as
@attacker.example/,//attacker.example/, absolute URLs, encoded delimiters, backslashes, and unexpected endpoints.
- Enforce an exact method-and-path allowlist in