T09 · Insecure Skill Coding Practices
Error
- Location
send.py:54- Finding
Unvalidated API Base URL Can Exfiltrate WeChat Credentials and Message Data
- Content
View full analysis
Vulnerability Details
File Location:
send.py, lines 54-78
Vulnerability Type: Untrusted credential destination / sensitive-data disclosure
Risk Level: HighVulnerable Code
python def send_text(to_user: str, text: str, account_id: str = None) -> dict: acct, acct_id = find_account(account_id) token = acct["token"] base_url = acct.get("baseUrl", "https://ilinkai.weixin.qq.com") ctx_token = find_context_token(acct_id, to_user) body = json.dumps({ "msg": { "from_user_id": "", "to_user_id": to_user, "client_id": generate_client_id(), "message_type": 2, "message_state": 2, "item_list": [{"type": 1, "text_item": {"text": text}}], "context_token": ctx_token, } }).encode() url = f"{base_url.rstrip('/')}/ilink/bot/sendmessage" req = urllib.request.Request( url, data=body, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {token}", "AuthorizationType": "ilink_bot_token", "X-WECHAT-UIN": random_wechat_uin(), }, method="POST", )Technical Analysis
The destination URL is derived from the
baseUrlfield of a local account JSON file. The implementation does not validate the URL scheme, hostname, port, embedded credentials, or resolved network address before attaching the WeChat bearer token and transmitting the request.Consequently, a modified or unexpectedly configured account file can direct the request to an attacker-controlled endpoint. The resulting request discloses:
- The WeChat bot bearer token in the
Authorizationheader. - The target user's identifier.
- The target user's context token.
- The complete outbound message.
- Request metadata associated with the bot operation.
The code also does not require HTTPS. ...[truncated 1702 chars]
- The WeChat bot bearer token in the
- Remediation
View remediation
Remediation Suggestions
- Remove configurable API destinations if they are not operationally required and always use
https://ilinkai.weixin.qq.com. - If configurability is required, implement a strict allowlist of approved HTTPS hostnames.
- Reject non-HTTPS schemes, unexpected ports, embedded URL credentials, fragments, and malformed URLs.
- Disable cross-origin redirects or verify every redirect target against the same allowlist before forwarding authorization headers.
- Consider validating DNS resolution to prevent approved-looking hostnames from resolving to loopback, link-local, or private infrastructure where inappropriate.
- Store account files with restrictive filesystem permissions and verify their ownership before reading credentials.
- Avoid returning raw remote response bodies in error messages because they may contain attacker-controlled content or sensitive server details.
- Add security tests proving that bearer tokens cannot be sent to HTTP endpoints or unapproved domains.
- Remove configurable API destinations if they are not operationally required and always use