T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/confluence.py:24
- Finding
- Confluence API Credentials Can Be Sent to an Unvalidated Network Destination<![CDATA[ ## Vulnerability Details **File Location**: `scripts/confluence.py:24-66`, with equivalent credential transmission at `scripts/confluence.py:82-138` and `scripts/confluence.py:449-466` **Vulnerability Type**: Unvalidated authentication destination and potential plaintext credential transmission **Risk Level**: Medium ### Vulnerable Code ```python def get_config(): """Get Confluence configuration from environment.""" base_url = os.environ.get("CONFLUENCE_BASE_URL", "").rstrip("/") email = os.environ.get("CONFLUENCE_USER_EMAIL", "") token = os.environ.get("CONFLUENCE_API_TOKEN", "") if not all([base_url, email, token]): missing = [] if not base_url: missing.append("CONFLUENCE_BASE_URL") if not email: missing.append("CONFLUENCE_USER_EMAIL") if not token: missing.append("CONFLUENCE_API_TOKEN") print(f"Error: Missing environment variables: {', '.join(missing)}", file=sys.stderr) sys.exit(1) return base_url, email, token def make_request(method, endpoint, data=None, params=None, api_version="v2"): """Make authenticated request to Confluence API.""" base_url, email, token = get_config() if api_version == "v2": url = f"{base_url}/wiki/api/v2{endpoint}" else: url = f"{base_url}/wiki/rest/api{endpoint}" if params: url = f"{url}?{urlencode(params)}" auth = base64.b64encode(f"{email}:{token}".encode()).decode() headers = { "Authorization": f"Basic {auth}", "Accept": "application/json", } body = None if data: headers["Content-Type"] = "application/json" body = json.dumps(data).encode() req = Request(url, data=body, headers=headers, method=method) try: with urlopen(req) as resp: ``` The same unsafe destination assumption is used for attachment upload: ```python def make_multipart_request(endpoint, file_path, comment=None): """Make ...[truncated 4356 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `CONFLUENCE_BASE_URL` with `urllib.parse.urlsplit` before using it. 2. Require the `https` scheme and reject plaintext HTTP. 3. Reject URLs containing embedded user information, fragments, malformed hosts, or unexpected ports. 4. Bind authentication to an explicitly configured tenant hostname or hostname allowlist. For Confluence Cloud, permit only the exact expected Atlassian tenant rather than accepting an arbitrary URL. 5. Resolve and reject loopback, link-local, and private-network destinations unless private Confluence deployments are an explicitly supported use case. 6. Disable automatic redirects for authenticated requests or validate every redirect target. Never forward `Authorization` across origins. 7. Apply the same destination validation to normal API calls, multipart uploads, and attachment downloads. 8. Update the documented `curl` examples to require a validated HTTPS tenant URL. 9. Use a narrowly scoped API token with only the Confluence permissions required by the intended workflow. 10. Document token rotation and immediate revocation procedures in case a destination is misconfigured. 11. Avoid logging request headers or the Base64 authentication value during future debugging or error handling. ]]>