T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kalodata/config.py:54- Finding
API Key Can Be Exfiltrated Through an Arbitrary or Insecure API Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/kalodata/config.py:54-64;scripts/kalodata/api.py:35-42, 91-100;scripts/kalodata/commands/meta.py:32-36, 68-72
Vulnerability Type: Unrestricted credential destination and insecure transport configuration
Risk Level: HighVulnerable Code
scripts/kalodata/config.py:54-64:python def pick(key: str, fallback: str | None = None) -> str | None: env = os.environ.get(ENV_KEYS[key]) if env: return env val = data.get(key) if val is not None: return str(val) return fallback return Config( api_key=pick("api_key"), base_url=pick("base_url", DEFAULT_BASE_URL) or DEFAULT_BASE_URL,scripts/kalodata/api.py:35-42:python def _headers(cfg: Config, extra: dict | None) -> dict: h = { "Content-Type": "application/json;charset=UTF-8", "secret-key": cfg.api_key, "source-type": "SKILL", } if extra: h.update(extra) return hscripts/kalodata/api.py:91-100:python """Call base_url+path (JSON body for POST, query params for GET); return the envelope's `data`.""" _require_auth(cfg) url = cfg.base_url.rstrip("/") + path headers = _headers(cfg, extra_headers) if method == "GET": if body: url += "?" + urllib.parse.urlencode(body) payload = None else: payload = json.dumps(body).encode("utf-8")scripts/kalodata/commands/meta.py:32-36,68-72:python updates = { "api_key": opts.get("key"), "base_url": opts.get("base_url"), "region": opts.get("region"), "language": opts.get("language"), "currency": opts.get("currency"), }python flags=[ Flag("--key", "KaloData API token (secret-key header)", metavar="KEY"), Flag("--base-url", "API base URL (default production)", metavar="URL"), Flag("--region", "default region", metavar="REGIO ...[truncated 2012 chars]- Remediation
View remediation
Remediation Suggestions
- Default to the fixed production endpoint and do not expose a configurable base URL unless it is operationally necessary.
- Enforce HTTPS and reject HTTP, non-network schemes, embedded credentials, fragments, unexpected ports, and malformed URLs.
- Allowlist trusted hosts, preferably only
www.kalodata.com, and validate the normalized hostname rather than using suffix matching. - If development endpoints are required, require a separate explicit opt-in and separate development credentials.
- Implement a redirect handler that rejects cross-origin redirects. Never forward
secret-keyto a host or scheme different from the validated original destination. - Validate environment-derived and file-derived configuration using the same policy as command-line configuration.
- Consider refusing to send production credentials whenever the endpoint differs from the production origin.
- Add tests covering HTTP URLs, attacker-controlled domains, embedded credentials, deceptive subdomains, alternate ports, and cross-origin redirects.