T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/standup-summarizer.sh:93
- Finding
- Zoho OAuth Token Sent to an Unvalidated Recording URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/standup-summarizer.sh`, lines 93 and 109-115 **Vulnerability Type**: Credential disclosure through an unvalidated remote URL **Risk Level**: High ### Vulnerable Code ```bash DOWNLOAD_URL=$(echo "$REC" | jq -r '.downloadUrl // .publicDownloadUrl') # Download recording echo " ⬇️ Downloading..." TOKEN=$(get_token) MP4_FILE="${TMP_DIR}/recording_${i}.mp4" HTTP_CODE=$(curl -s -w "%{http_code}" -o "$MP4_FILE" -L \ -H "Authorization: Zoho-oauthtoken ${TOKEN}" \ "$DOWNLOAD_URL") ``` ### Technical Analysis `DOWNLOAD_URL` is extracted from a remote Zoho API response and passed directly to `curl` without validating its scheme or hostname. The request includes a valid Zoho OAuth access token in the `Authorization` header. Although the URL normally points to a Zoho-controlled file service, the script does not enforce that security assumption. If the recording metadata is maliciously modified, a compromised API response is received, or an unexpected URL is returned, the initial request can be sent to an attacker-controlled server together with the OAuth token. The `-L` option also follows redirects. While curl versions commonly restrict forwarding authorization headers across different hosts, relying on client-version-specific redirect behavior is not an adequate security boundary. The initial unvalidated URL remains sufficient to expose the token. ### Attack Path 1. An attacker compromises or manipulates the recording metadata received by the script. 2. The `downloadUrl` or `publicDownloadUrl` field is changed to an attacker-controlled HTTPS endpoint. 3. The script extracts that URL without validation. 4. The script obtains a valid Zoho access token through `bin/zoho token`. 5. `curl` sends `Authorization: Zoho-oauthtoken <token>` to the attacker-controlled endpoint. 6. The attacker captures and reuses the token until it expires. ### Impact Assessment A successful exploit discloses a valid Zoho ...[truncated 533 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse every recording URL and require the `https` scheme. 2. Enforce an explicit allowlist of expected Zoho file-service hostnames for each supported region. 3. Reject URLs containing unexpected ports, user-information components, IP literals, or non-Zoho hostnames. 4. Do not attach the OAuth header to a URL unless its destination has passed validation. 5. Disable automatic redirects or validate each redirect destination before following it. 6. Prefer a fixed Zoho API endpoint that accepts a recording identifier instead of trusting a URL returned in metadata. 7. Reduce OAuth scopes to only those required for the requested operation and avoid requesting CRM or Projects write access for meeting transcription. 8. Revoke and rotate any token suspected of having been sent to an untrusted endpoint. ]]>