T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/feishu-bitable.js:8
- Finding
- Arbitrary API Base URL Can Exfiltrate Feishu Credentials and Data in Bitable Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-bitable.js:8-10, 37-45, 76-82` **Vulnerability Type**: Unrestricted credential destination **Risk Level**: High ### Vulnerable Code ```js const BASE_URL = process.env.FEISHU_BASE_URL || 'https://open.feishu.cn/open-apis'; const APP_ID = process.env.FEISHU_APP_ID; const APP_SECRET = process.env.FEISHU_APP_SECRET; async function feishuFetch(path, { method = 'GET', token, body, retryCount = 0, maxRetries = 5 } = {}) { const headers = { 'Content-Type': 'application/json' }; if (token) headers.Authorization = `Bearer ${token}`; const res = await fetch(`${BASE_URL}${path}`, { method, headers, body: body ? JSON.stringify(body) : undefined, }); } async function getTenantToken() { requiredEnv(); const res = await feishuFetch('/auth/v3/tenant_access_token/internal', { method: 'POST', body: { app_id: APP_ID, app_secret: APP_SECRET }, }); return res.tenant_access_token; } ``` ### Technical Analysis The script permits `FEISHU_BASE_URL` to replace the trusted Feishu API origin without validating the URL scheme or hostname. The application ID and secret are sent to this configurable origin during token acquisition. Subsequent requests also send the resulting bearer token and Bitable content to the same origin. Supporting alternate official deployments can be legitimate, but accepting any process-environment value creates a credential-exfiltration boundary. An attacker who can influence the environment, a launcher, CI configuration, or an agent command can redirect all API traffic to an attacker-controlled server. This behavior is not necessary for the Skill's default Bitable functionality. The official `https://open.feishu.cn/open-apis` endpoint is sufficient unless a strictly validated alternative is explicitly required. ### Attack Path 1. The attacker gains the ability to influence the process environment or execution wrapper. 2. The attacker sets `FEISHU_BASE ...[truncated 1056 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `FEISHU_BASE_URL` if alternate API origins are not required. - If an override is necessary, parse it with `new URL()` and require `https:`. - Enforce an explicit hostname allowlist, such as `open.feishu.cn`, instead of accepting arbitrary origins. - Reject URLs containing embedded credentials, unexpected ports, fragments, or nonempty paths outside the approved API prefix. - Separate token acquisition from ordinary requests and hard-code its trusted origin. - Avoid forwarding bearer tokens across redirects; preferably disable redirects or verify every redirect destination. - Document any supported private proxy and require an explicit trusted configuration rather than an ambient environment override. - Rotate `FEISHU_APP_SECRET` immediately if the script has been run with an untrusted base URL. ]]>