T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_shopee_bundle_deal_common.py:18- Finding
Credential Exfiltration Through Unrestricted Endpoint Overrides
- Content
View full analysis
Vulnerability Details
File Location:
scripts/_shopee_bundle_deal_common.py:18-20, 55-88;scripts/onboarding.py:69-85, 189-222, 402-421, 454-459
Vulnerability Type: Unvalidated credential-bearing endpoint configuration
Risk Level: HighVulnerable Code
python API_BASE_URL = os.environ.get("LINKFOX_TOOL_GATEWAY") or os.environ.get("SHOPEE_API_BASE_URL") or "https://tool-gateway.linkfox.com" STORE_TOKENS_ENDPOINT = f"{API_BASE_URL.rstrip('/')}/shopee/storeTokens" DEVELOPER_PROXY_ENDPOINT = f"{API_BASE_URL.rstrip('/')}/shopee/developerProxy"python def get_api_key() -> str: """ Get the API key configured in the environment. """ key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured", file=sys.stderr, ) sys.exit(1) return key def call_api(endpoint: str, params: dict) -> dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else "" return {"error": f"HTTP {e.code}: {e.reason}", "details": body} except URLError as e: return {"error": f"Connection failed: {e.reason}"}The onboard ...[truncated 6409 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin production requests to the documented HTTPS endpoints:
https://tool-gateway.linkfox.comhttps://api.linkfox.comhttps://agent-api.linkfox.com
- If endpoint overrides are required for testing, require an explicit development-only flag that is disabled by default.
- Parse every configured URL and enforce:
- The
httpsscheme. - An exact hostname allowlist.
- Approved ports only.
- No embedded username or password.
- No fragments or unexpected path prefixes.
- The
- Disable cross-origin redirects for requests containing credentials, or validate every redirect destination against the same allowlist.
- Reject loopback, link-local, private, and metadata-service destinations unless a deliberately isolated test mode is active.
- Separate credential-bearing clients from generic HTTP helpers so arbitrary URLs cannot be passed to authenticated request functions.
- Avoid transmitting session metadata headers unless each field is necessary and documented.
- Document all recipients and data categories involved in onboarding before requesting a phone number or SMS code.
- Add automated tests confirming that non-HTTPS and non-LinkFox destinations are rejected before any sensitive request is sent.
- Pin production requests to the documented HTTPS endpoints: