T09 · Insecure Skill Coding Practices
- Location
scripts/transcribe.sh:4- Finding
Attacker-Controlled Destination Can Receive the Bearer Token and Audio Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/transcribe.sh, lines 4–10 and 34–39
Vulnerability Type: Unvalidated destination URL causing credential and data disclosure
Risk Level: HighVulnerable Code
bash if [[ $# -lt 1 ]]; then echo "Usage: $0 <audio-file> [url]" exit 1 fi FILE="$1" URL="${2:-https://lotfi-whisper-worker.medtouradmin.workers.dev/transcribe}"bash curl -sS -X POST "$URL" \ -H "content-type: $ctype" \ -H "authorization: Bearer $WHISPER_WORKER_TOKEN" \ --data-binary "@$FILE" \ | jq -r '.result.text // .text // .result.response // empty'Technical Analysis
The script accepts an optional second command-line argument and uses it directly as the destination supplied to
curl. It does not restrict the URL scheme or validate the destination hostname against the documented Cloudflare Worker.Every request includes the
WHISPER_WORKER_TOKENbearer credential and the complete contents of the selected audio file. Consequently, anyone able to influence the script invocation can redirect both assets to an arbitrary server. A non-HTTPS URL can additionally expose them to network interception.This is not shell command injection because
"$URL"is quoted. The vulnerability is instead an unsafe trust-boundary decision: attacker-controlled input determines which origin receives sensitive authentication and user data.Attack Path
- An attacker persuades a user or agent to invoke the script with an attacker-controlled URL as its second argument.
- The user has a valid
WHISPER_WORKER_TOKENin the environment and selects an audio file for transcription. - The script assigns the supplied URL to
URLwithout scheme or hostname validation. curlsends the bearer token in theAuthorizationheader and uploads the complete audio file to that destination.- The attacker records the credential and audio data.
- The attacker may re ...[truncated 779 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the optional URL argument and hardcode the documented endpoint:
bash URL="https://lotfi-whisper-worker.medtouradmin.workers.dev/transcribe" - If endpoint overrides are operationally necessary, require HTTPS and enforce an exact hostname and path allowlist before attaching credentials.
- Reject URLs containing alternate schemes, unexpected ports, embedded credentials, redirects to untrusted origins, or non-allowlisted hosts.
- Configure
curlto use HTTPS-only protocols and fail on HTTP errors:bash curl --proto '=https' --fail-with-body --silent --show-error ... - Avoid forwarding authorization headers across redirects. Prefer disabling redirects; if redirects are required, validate the final destination and ensure credentials are never sent to another origin.
- Rotate any token suspected of having been used with an untrusted URL and apply least-privilege scope, expiration, and usage limits to future tokens.
- Clearly notify users that transcription uploads the selected audio to an external service.
- Remove the optional URL argument and hardcode the documented endpoint: