T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:77
- Finding
- Unrestricted API Endpoint Can Disclose Identity Documents and API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:77`, `scripts/main.py:85-111` **Vulnerability Type**: Unvalidated configurable network destination **Risk Level**: High ### Vulnerable Code ```python config.setdefault('SCNET_API_BASE', 'https://api.scnet.cn/api/llm/v1') ``` ```python api_base = config['SCNET_API_BASE'] api_key = config['SCNET_API_KEY'] url = f"{api_base}/ocr/recognize" headers = { 'Authorization': f'Bearer {api_key}' } try: with open(file_path, 'rb') as f: files = { 'file': (os.path.basename(file_path), f, mime_type) } data = { 'ocrType': ocr_type, 'channelTag': "scnetSkills" } response = requests.post( url, headers=headers, data=data, files=files, timeout=60 ) except Exception as e: sys.exit(f"Network request failed: {str(e)}") ``` ### Technical Analysis The OCR operation legitimately requires sending the selected document to the SCNet cloud service. However, `SCNET_API_BASE` is read from configuration and used verbatim to construct the request URL. The implementation does not parse or validate the configured URL before attaching the bearer credential and uploading the complete document. In particular, it does not enforce: - The HTTPS scheme. - The documented `api.scnet.cn` hostname. - An approved port or path prefix. - The absence of embedded URL credentials. - A destination allowlist. - A policy for redirects. Because `requests.post` follows redirects by default, destination handling also depends on implicit library behavior rather than an explicit policy suitable for identity-document uploads. The Skill only needs access to the documented SCNet API for its declared function. Permitting transmission to arbitrary destinations exceeds that minimum network privilege. ### Attack Path 1. An attacker, compromised automation component, or misleading setup instr ...[truncated 1191 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for a configurable API destination unless custom deployments are a documented requirement. 2. If configurability is required, parse the URL with a standard URL parser and enforce: - Scheme exactly equal to `https`. - Hostname exactly equal to an approved hostname such as `api.scnet.cn`. - Approved destination ports only. - An expected path prefix. - No embedded username or password. 3. Use an explicit hostname allowlist rather than suffix matching, which can accept deceptive domains. 4. Set `allow_redirects=False` for sensitive uploads. If redirects are operationally required, validate every redirect target before resending credentials or document content. 5. Require explicit user confirmation before using any non-default enterprise endpoint. 6. Keep the API credential scoped to the minimum required service operations and support rapid rotation. 7. Add tests that reject HTTP URLs, deceptive subdomains, embedded credentials, unexpected ports, malformed URLs, and unapproved redirect targets. 8. Clearly disclose the destination, data categories, retention policy, and third-party processing implications before uploading identity documents. ]]>