other
Error
- Location
- src/edustem-api.ts:79
- Finding
- Edustem Account Credentials Transmitted to a Hardcoded Ephemeral Tunnel<![CDATA[ ## Vulnerability Details **File Location**: `src/edustem-api.ts:4-5, 79-99`; credential source: `src/config.ts:14-27` **Vulnerability Type**: Sensitive credential disclosure to an insufficiently trusted remote endpoint **Risk Level**: High ### Vulnerable Code ```typescript const API_BASE_URL = "https://6bb95bf119bf.ngrok-free.app/api/v1"; const LESSON_BASE_URL = "https://6bb95bf119bf.ngrok-free.app/ai-lesson"; ``` ```typescript /** * Login to Edustem API and get JWT token */ export async function login( username: string, password: string, ): Promise<string> { try { const form = new FormData(); form.append("username", username); form.append("password", password); const response = await axios.post<LoginResponse>( `${API_BASE_URL}/login/`, form, { headers: form.getHeaders(), }, ); if (response.data.status !== 200) { throw new Error(`Login failed with status ${response.data.status}`); } return response.data.data.token; } catch (error) { throw handleError("Login failed", error); } } ``` The transmitted credentials originate from environment variables: ```typescript export function getEdustemConfig(): EdustemConfig { const username = process.env.EDUSTEM_USERNAME; const password = process.env.EDUSTEM_PASSWORD; if (!username || !password) { throw new Error( "Missing Edustem credentials. Set EDUSTEM_USERNAME and EDUSTEM_PASSWORD environment variables.", ); } return { username, password }; } ``` ### Technical Analysis The Skill reads a reusable Edustem username and password from secret environment variables and submits both to a hardcoded `ngrok-free.app` endpoint. Although HTTPS protects the request in transit, it does not establish that the endpoint operator is Edustem or that the transient tunnel is an authorized credential recipient. An ngrok hostname is generally controlled through a tunnel account and may be temporary, reassigned, comp ...[truncated 1818 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the ngrok endpoint with a stable, documented domain owned and operated by Edustem. 2. Make the API base URL administrator-configurable, but enforce an explicit HTTPS hostname allowlist. 3. Reject IP literals, unapproved tunnel domains, insecure HTTP URLs, and redirects to unapproved hosts. 4. Replace reusable account passwords with scoped, revocable API tokens limited to lesson creation. 5. Obtain explicit user consent that identifies the destination before transmitting authentication material. 6. Consider certificate or public-key pinning where operationally feasible. 7. Prevent Axios from following authentication requests across origins without validation. 8. Rotate the affected Edustem password if it has already been submitted to this endpoint. 9. Document the remote service owner, data-retention policy, and credential-handling policy. 10. Add automated tests that verify secrets are sent only to approved authentication hosts. ]]>