T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ninebot_query.py:51
- Finding
- Configurable Network Destination Can Disclose the Ninebot API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ninebot_query.py`, lines 51-55, 103-129, and 157-160 **Vulnerability Type**: Unrestricted authenticated network destination **Risk Level**: High ### Complete Vulnerable Code ```python def get_base_url(cfg: Dict[str, Any], section: str) -> str: section_url = (cfg.get(section) or {}).get("base_url") if section_url: return section_url return cfg.get("base_url", "") ``` ```python def inject_api_key_header(cfg: Dict[str, Any], headers: Dict[str, str], api_key: str): auth_cfg = cfg.get("auth") or {} header_name = auth_cfg.get("api_key_header") or "x-api-key" prefix = auth_cfg.get("api_key_prefix") or "" headers[header_name] = f"{prefix}{api_key}" def list_devices(cfg: Dict[str, Any], api_key: str, lang: str): url = get_base_url(cfg, "devices").rstrip("/") + cfg["devices"]["path"] payload_tpl = cfg["devices"].get("payload") or {} payload = { k: (v.format(api_key=api_key, lang=lang) if isinstance(v, str) else v) for k, v in payload_tpl.items() } headers: Dict[str, str] = {} if api_key: inject_api_key_header(cfg, headers, api_key) payload_to_send = None if cfg["devices"]["method"].upper() == "GET" else payload res = http_request(cfg["devices"]["method"], url, headers=headers, payload=payload_to_send) devices = deep_get(res, cfg["devices"]["list_path"]) or [] return devices def get_device_info(cfg: Dict[str, Any], api_key: str, sn: str): path = cfg["device_info"]["path"].replace("{sn}", urllib.parse.quote(sn)) url = get_base_url(cfg, "device_info").rstrip("/") + path payload_tpl = cfg["device_info"].get("payload") or {} payload = { k: (v.format(api_key=api_key, sn=sn) if isinstance(v, str) else v) for k, v in payload_tpl.items() } headers: Dict[str, str] = {} if api_key: inject_api_key_header(cfg, headers, api_key) res = http_request(cfg["device_inf ...[truncated 2649 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin authenticated requests to an explicit allowlist of approved Ninebot hosts, such as `cn-cbu-gateway.ninebot.com`. 2. Require the `https` scheme and reject plaintext HTTP destinations. 3. Normalize and validate the parsed hostname before attaching the API key. 4. Do not forward authorization headers if a redirect changes the request origin. 5. Remove per-section destination overrides unless they are operationally required. 6. If custom endpoints are required for development, require an explicit opt-in flag and display the destination before sending credentials. 7. Load configuration from a fixed, trusted location rather than implicitly trusting `config.json` in the current working directory. 8. Separate non-sensitive response-field mappings from security-sensitive settings such as destination, authentication header, and transport scheme. ]]>