T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:303- Finding
Bearer Token Disclosure Through an Unrestricted OAuth2 Introspection Endpoint
- Content
View full analysis
{ const authHeader = req.headers.authorization; if (!authHeader) { return res.status(401).json({ code: 2001, message: '未授权', data: null }); } const token = authHeader.slice(7); try { const resp = await fetch(introspectUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: `token=${token}` }); ``` ### Technical Analysis The generated OAuth2 middleware extracts a sensitive access token from the incoming `Authorization` header and transmits it to the supplied `introspectUrl`. No restrictions are placed on this destination. If an attacker can influence deployment configuration or otherwise control `introspectUrl`, the middleware will send users' bearer tokens to an attacker-controlled server. The same primitive can cause server-side requests to loopback, private-network, link-local, or cloud metadata endpoints. Additional weaknesses include: - The destination is not restricted to trusted HTTPS hosts. - Redirect behavior is not controlled. - Private and special-purpose IP ranges are not rejected. - The code checks only whether the authorization header exists, not whether it follows the `Bearer <token>` scheme. - The token is interpolated directly into form data instead of being safely encoded. - No request timeout is configured. - The generated introspection request does not demonstrate client authentication, which is commonly required by OAuth2 introspection endpoints. - Declaring the middleware factory itself as `async` returns a Promise instead of middleware directly, potentially causing integration errors. Sending a token to a configured OAuth2 ...[truncated 1842 chars]- Remediation
View remediation
`. 6. Encode the request body safely: ```javascript const body = new URLSearchParams({ token }); ``` 7. Use the introspection service's required client authentication mechanism and retrieve client credentials from a protected secret manager or environment configuration. 8. Add a short request timeout, response-size limit, and controlled error handling. Do not log tokens or include them in error messages. 9. Remove the unnecessary `async` modifier from the factory unless asynchronous initialization is required: ```javascript function authOAuth2(introspectUrl) { return async (req, res, next) => { // Middleware implementation }; } ``` 10. Prefer accepting a preconfigured introspection client rather than a raw URL. This centralizes TLS, destination validation, authentication, timeout, and logging policy. 11. Add tests confirming rejection of non-HTTPS URLs, redirects, unapproved hosts, private addresses, malformed authorization headers, and timeout conditions. ]]>