T09 · Insecure Skill Coding Practices
Error
- Location
solpaw-skill.ts:72- Finding
Bearer API Credential Can Be Sent to an Arbitrary Configured Endpoint
- Content
View full analysis
( method: string, path: string, body?: Record, headers?: Record ): Promise { const url = `${this.config.apiEndpoint}${path}`; const response = await fetch(url, { method, headers: { "Content-Type": "application/json", Authorization: `Bearer ${this.config.apiKey}`, ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(120000), // 2 min timeout for launches }); ``` ### Technical Analysis The constructor accepts an arbitrary `apiEndpoint` and only removes a trailing slash. It does not require HTTPS or validate the destination against a trusted hostname or origin. The shared request function unconditionally attaches the SolPaw API key as a bearer credential. Consequently, anyone who can modify Skill configuration can direct authenticated requests to an attacker-controlled HTTP or HTTPS service. Plain HTTP endpoints would additionally expose the credential to network interception. Allowing caller-provided headers to override default headers through `...headers` also weakens control over authentication and content-type behavior, although the primary issue is the unrestricted credential destination. ### Attack Path 1. An attacker modifies the Skill configuration or supplies a malicious `apiEndpoint`, such as `https://attack ...[truncated 998 chars]- Remediation
View remediation