T09 · Insecure Skill Coding Practices
Warning
- Location
- solpaw-skill.ts:83
- Finding
- API Credentials Can Be Transmitted to an Arbitrary Configured Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `solpaw-skill.ts`, lines 83-91 and 97-116 **Vulnerability Type**: Unrestricted credential-bearing network destination **Risk Level**: Medium ### Vulnerable Code ```typescript constructor(config: SolPawConfig) { if (!config.apiEndpoint) throw new Error("SolPaw: apiEndpoint is required"); if (!config.apiKey) throw new Error("SolPaw: apiKey is required"); if (!config.defaultCreatorWallet) throw new Error("SolPaw: defaultCreatorWallet is required"); this.config = { ...config, apiEndpoint: config.apiEndpoint.replace(/\/$/, ""), }; } ``` ```typescript private async request<T>( method: string, path: string, body?: Record<string, unknown>, headers?: Record<string, string> ): Promise<T> { const url = `${this.config.apiEndpoint}${path}`; const response = await fetch(url, { method, headers: { "Content-Type": "application/json", Authorization: `Bearer ${this.config.apiKey}`, ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(120000), }); ``` ### Technical Analysis The constructor accepts any nonempty `apiEndpoint` and performs no scheme, origin, or host validation. The common request function then attaches the SolPaw API key as a Bearer credential to every request made against that endpoint. Consequently, the API key can be disclosed if the endpoint is changed to an attacker-controlled server through a malicious configuration, configuration injection, deployment mistake, or compromised agent configuration. The code also does not require HTTPS, so a configured plaintext HTTP endpoint could expose credentials and request bodies to network interception. The outbound request body may additionally contain the creator wallet, payment transaction signature, CSRF token, token metadata, social links, and fee parameters. Most of those fields are necessary for the hosted launch service, but they must only be s ...[truncated 1212 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to a fixed, trusted SolPaw API origin and do not expose endpoint replacement unless self-hosting is explicitly enabled. 2. Parse the endpoint with `new URL()` and require the `https:` scheme. 3. Enforce an explicit hostname and port allowlist for the hosted mode, such as `api.solpaw.fun` on port 443. 4. If custom self-hosted endpoints are necessary, require a separate opt-in flag and separate credentials that are not valid against the hosted service. 5. Reject endpoints containing embedded credentials, unexpected ports, fragments, or unapproved URL schemes. 6. Before attaching the Authorization header, verify that the final URL origin exactly matches the approved origin. 7. Prevent redirects from forwarding credentials to another origin by disabling redirects or validating every redirect destination. 8. Document precisely which account and launch data is transmitted to the service. ]]>