T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fetch-cpap.py:53
- Finding
- Configurable API Origin Can Receive PrismaAPP Credentials and Bearer Tokens<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch-cpap.py:53-69`, `scripts/fetch-cpap.py:229`, and `scripts/fetch-cpap.py:239` **Vulnerability Type**: Unvalidated authentication destination **Risk Level**: High ### Vulnerable Code ```python def login(email: str, password: str, api_base: str) -> str: resp = http_post_form(f"{api_base}/connect/token", { "grant_type": "password", "username": email, "password": password, "scope": "profile offline_access", "tenant": "patientapp", "client_id": "patient-app-client", }) return resp["access_token"] # ── API ──────────────────────────────────────────────────────────────────────── def get_dashboard(token: str, api_base: str) -> dict: return http_get(f"{api_base}/api/Dashboard", token) def get_week(token: str, date_in_week: str, api_base: str) -> list[dict]: data = http_get(f"{api_base}/api/Dashboard/week?dateInWeek={date_in_week}", token) ``` The destination is read directly from configuration and then used for authentication: ```python api_base = cfg.get("api_base", "https://my.prismacloud.com").rstrip("/") ``` ```python token = login(cfg["email"], cfg["password"], api_base) ``` Authenticated requests also transmit the resulting token: ```python def http_get(url: str, token: str) -> dict: req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}", "Accept": "application/json"}) with urllib.request.urlopen(req, timeout=15) as r: return json.loads(r.read()) ``` ### Technical Analysis The Skill's declared functionality requires network access to the PrismaAPP service. Sending credentials to the official authentication endpoint and using a bearer token to retrieve CPAP records are therefore functionally necessary. However, the implementation does not enforce that `api_base` is the documented official origin, `https://my.prismacloud.com`. It accepts any configured ...[truncated 2237 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `api_base` from user-controlled configuration if alternate deployments are not required. 2. Pin all authentication and API requests to `https://my.prismacloud.com`. 3. If configurability is necessary, parse the URL and require: - Scheme exactly equal to `https` - Hostname exactly equal to an explicit allowlisted hostname - Port absent or equal to `443` - No embedded username or password - No fragments or unexpected path prefix 4. Reject redirects to a different origin. Authentication credentials and bearer tokens must never be forwarded across origins. 5. Keep authentication and API endpoint construction centralized rather than accepting arbitrary complete URLs. 6. Fail closed with a clear error when origin validation fails. 7. Add tests covering malicious values such as `http://example.test`, lookalike domains, embedded user information, nonstandard ports, and cross-origin redirects. 8. Prefer a modern authorization flow using revocable, narrowly scoped tokens if the service supports one, rather than repeatedly storing and transmitting the account password. ]]>