T09 · Insecure Skill Coding Practices
Error
- Location
- lib/amadeus_client.py:17
- Finding
- Unrestricted API endpoint configuration can exfiltrate credentials<![CDATA[ ## Vulnerability Details **File Location**: `lib/amadeus_client.py:17-42`; the same design flaw also appears in `lib/aviationstack_client.py:17-20, 51-74, 199-210` **Vulnerability Type**: User-controlled credential transmission destination **Risk Level**: High ### Vulnerable Code ```python def __init__(self, api_key: str, api_secret: str, sandbox: bool = True, base_url_test: str = None, base_url_production: str = None): self.api_key = api_key self.api_secret = api_secret self.sandbox = sandbox # Use URLs from config or defaults test_url = base_url_test or "https://test.api.amadeus.com" prod_url = base_url_production or "https://api.amadeus.com" self.auth_url = f"{test_url if sandbox else prod_url}/v1/security/oauth2/token" self.api_url = test_url if sandbox else prod_url self.token = None self.token_expires_at = None def authenticate(self) -> bool: """Get OAuth2 token from Amadeus API""" url = self.auth_url data = { "grant_type": "client_credentials", "client_id": self.api_key, "client_secret": self.api_secret } try: response = requests.post(url, data=data, timeout=30) ``` The equivalent AviationStack behavior is: ```python def __init__(self, api_key: str, base_url: str = None): self.api_key = api_key # Default to HTTPS for security (API key sent in query params) self.base_url = base_url or "https://api.aviationstack.com/v1" self.request_count = 0 self.monthly_limit = 100 # Free tier limit ``` ```python url = f"{self.base_url}/flights" params = {"access_key": self.api_key} # Add optional parameters if flight_iata: params["flight_iata"] = flight_iata.upper() elif flight_icao: params["flight_icao"] = flight_icao.upper() if flight_number: params["flight_number"] = flight_number if date: params["flight_date"] = date if dep_iata: params["dep_iata"] = dep_iata.upper() if arr_iata: params["arr_i ...[truncated 2867 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Allowlist official API origins** - Accept only `https://test.api.amadeus.com` and `https://api.amadeus.com` for Amadeus. - Accept only `https://api.aviationstack.com` with the expected API path for AviationStack. - Compare parsed, normalized origins rather than using string-prefix checks. 2. **Enforce HTTPS** - Parse URLs with `urllib.parse.urlsplit`. - Reject every scheme other than `https`. - Reject embedded usernames or passwords, unexpected ports, malformed hosts, fragments, and protocol-relative URLs. 3. **Remove production endpoint overrides where unnecessary** - Hardcode trusted production origins. - If custom endpoints are needed for testing, require an explicit development-only option and display a prominent warning. - Prevent production credentials from being used with custom endpoints. 4. **Harden redirect behavior** - Disable redirects on credential-bearing authentication requests with `allow_redirects=False`, or validate every redirect destination against the same allowlist before following it. 5. **Protect AviationStack keys** - Use an authorization header if supported by the provider. - Ensure request URLs containing keys are never logged. - Document the unavoidable query-string exposure if the provider requires that authentication method. 6. **Respond to suspected exploitation** - Revoke and rotate affected credentials. - Review API usage and billing records. - Remove untrusted endpoint overrides from configuration. ]]>