T09 · Insecure Skill Coding Practices
- Location
scripts/netpad.sh:7- Finding
Bearer Token Disclosure Through an Unrestricted Configurable API Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/netpad.sh, lines 7–34
Vulnerability Type: Credential exfiltration through an unvalidated destination
Risk Level: HighVulnerable Code
bash BASE_URL="${NETPAD_BASE_URL:-https://www.netpad.io/api/v1}" # Check credentials if [[ -z "${NETPAD_API_KEY:-}" ]]; then echo "Error: NETPAD_API_KEY must be set" >&2 echo " export NETPAD_API_KEY=np_live_xxx" >&2 exit 1 fi # API request helper api() { local method="$1" endpoint="$2" data="${3:-}" local args=( --silent --header "Authorization: Bearer ${NETPAD_API_KEY}" --header "Content-Type: application/json" -X "$method" ) if [[ -n "$data" ]]; then args+=(--data "$data") fi curl "${args[@]}" "${BASE_URL}${endpoint}" }Technical Analysis
The script permits
NETPAD_BASE_URLto replace the official NetPad API origin without validating its scheme, hostname, port, or trust level. Theapihelper then unconditionally addsNETPAD_API_KEYas a bearer token to every request sent to that origin.Consequently, an attacker who can influence the process environment can redirect authenticated requests to an attacker-controlled server. The shell argument arrays prevent ordinary shell-command injection, but they do not prevent credential disclosure at the HTTP layer.
The same redirected request may contain sensitive request bodies, including form definitions or submission data. Restricting the default URL to HTTPS is insufficient because the environment variable can replace the complete destination.
Attack Path
- The attacker influences the environment used to launch the wrapper, such as through a compromised shell profile, CI variable, task configuration, or wrapper script.
- The attacker sets
NETPAD_BASE_URLto an HTTPS endpoint under their control:bas
...[truncated 1146 chars]
- Remediation
View remediation
Remediation Suggestions
- Allowlist the exact official origin and require HTTPS:
bash DEFAULT_BASE_URL="https://www.netpad.io/api/v1" BASE_URL="${NETPAD_BASE_URL:-$DEFAULT_BASE_URL}" case "$BASE_URL" in "$DEFAULT_BASE_URL") ;; *) echo "Error: untrusted NETPAD_BASE_URL" >&2 exit 1 ;; esac - If staging or self-hosted deployments must be supported, maintain an explicit allowlist of trusted HTTPS origins rather than accepting arbitrary URLs.
- Parse and validate the URL structurally, rejecting non-HTTPS schemes, embedded credentials, unexpected ports, fragments, and hostnames that only suffix-match a trusted domain.
- Require separate credentials for each configured origin. Do not reuse or forward a production token when a custom base URL is selected.
- Consider requiring an explicit command-line confirmation for non-production destinations and suppressing credentials unless the destination has been approved.
- Rotate any API key that may already have been used while
NETPAD_BASE_URLpointed to an untrusted endpoint.
- Allowlist the exact official origin and require HTTPS: