T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search.sh:73
- Finding
- Bearer Credential Disclosure Through an Unrestricted API Destination## Vulnerability Details **File Location**: `scripts/search.sh`, lines 73–77 **Vulnerability Type**: Unrestricted credential destination **Risk Level**: Medium ### Vulnerable Code ```bash RESPONSE=$(curl -s -G \ --url "https://${CLOUDSWAYS_BASE_PATH}/search/${CLOUDSWAYS_ENDPOINT}/smart" \ --header "Authorization: Bearer ${CLOUDSWAYS_AK}" \ --header "pragma: no-cache" \ "${CURL_ARGS[@]}") ``` ### Technical Analysis The script constructs the request URL from the environment-controlled `CLOUDSWAYS_BASE_PATH` value and unconditionally sends `CLOUDSWAYS_AK` to that destination as a bearer credential. It does not validate the resulting hostname against an allowlist of official Cloudsways service domains. Consequently, any party capable of influencing the script's environment can select an attacker-controlled HTTPS host. The use of TLS does not prevent this disclosure because TLS only protects the connection to the selected host; it does not establish that the selected host is an authorized recipient of the credential. The accompanying documentation requires users to configure the destination through `CLOUDSWAYS_BASE_PATH`, but it does not impose a hostname restriction. Although `SKILL.md` provides `searchmcp.cloudsway.net` as an MCP example, the shell script does not enforce that or another documented official domain. ### Attack Path 1. An attacker influences environment configuration, a wrapper script, deployment settings, or copied setup instructions. 2. The attacker sets `CLOUDSWAYS_BASE_PATH` to an HTTPS host under their control. 3. A user or agent invokes `scripts/search.sh` with a search request. 4. The script connects to the attacker-selected host. 5. The request includes `Authorization: Bearer ${CLOUDSWAYS_AK}`. 6. The attacker captures the access key and the submitted search query. 7. Subject to the API key's server-side permissions, the attacker can replay the credential against the legitimate service. ### Impact Assessment Success ...[truncated 516 chars]
- Remediation
- ## Remediation Suggestions 1. Hardcode the official API hostname when only one service destination is supported. 2. If destination configurability is required, validate the canonical hostname against a strict allowlist of documented Cloudsways domains before invoking `curl`. 3. Keep tenant, endpoint, and path identifiers separate from the network hostname; do not accept a complete credential destination through an unrestricted environment variable. 4. Reject values containing schemes, user-information components, ports, path separators, query delimiters, fragments, whitespace, control characters, or other URL metacharacters. 5. Fail closed when destination validation fails, and never attach the `Authorization` header to an unapproved host. 6. Consider using a restrictive curl configuration such as `--proto '=https'` and appropriate redirect controls. If redirects are enabled in the future, ensure credentials cannot be forwarded to another origin. 7. Document the exact approved hostname format and rotate the access key if it may previously have been sent to an untrusted destination. 8. Apply server-side least privilege, expiration, usage monitoring, and revocation controls to reduce the impact of credential disclosure.