T09 · Insecure Skill Coding Practices
Error
- Location
- refs/cli-rest-quickref.md:31
- Finding
- Jira credentials can be transmitted to an unrestricted configured host<![CDATA[ ## Vulnerability Details **File Location**: `refs/cli-rest-quickref.md:31-69` **Additional Locations**: `SKILL.md:40, 154-171`; `refs/cli-rest-quickref.md:122-156` **Vulnerability Type**: Unvalidated credential destination **Risk Level**: High ### Vulnerable Code ```bash local base="${ATREST_JIRA_BASE_URL%/}" local ua="${ATREST_JIRA_USER_AGENT:-openClaw-jira-atrest/1.0}" local auth_header if [ "$ATREST_JIRA_AUTH_MODE" = "basic" ]; then : "${ATREST_JIRA_EMAIL:?Missing ATREST_JIRA_EMAIL}" : "${ATREST_JIRA_API_TOKEN:?Missing ATREST_JIRA_API_TOKEN}" auth_header="Authorization: Basic $(printf '%s' "${ATREST_JIRA_EMAIL}:${ATREST_JIRA_API_TOKEN}" | base64 | tr -d '\n')" elif [ "$ATREST_JIRA_AUTH_MODE" = "bearer" ]; then : "${ATREST_JIRA_BEARER_TOKEN:?Missing ATREST_JIRA_BEARER_TOKEN}" auth_header="Authorization: Bearer ${ATREST_JIRA_BEARER_TOKEN}" else echo "Unsupported auth mode: $ATREST_JIRA_AUTH_MODE" >&2 return 1 fi local url="${base}${path}" if [ -n "$query" ]; then url="${url}?${query}" fi if [ -n "$body_file" ]; then curl --silent --show-error --fail \ --request "$method" \ --url "$url" \ --header "Accept: application/json" \ --header "Content-Type: application/json" \ --header "$auth_header" \ --header "User-Agent: $ua" \ --data-binary "@$body_file" else curl --silent --show-error --fail \ --request "$method" \ --url "$url" \ --header "Accept: application/json" \ --header "$auth_header" \ --header "User-Agent: $ua" fi ``` The PowerShell implementation follows the same pattern: ```powershell $base = $env:ATREST_JIRA_BASE_URL.TrimEnd('/') $uri = if ($Query) { "$base$Path?$Query" } else { "$base$Path" } $headers = @{ Accept = 'application/json' Authorization = $auth 'User-Agent' = $ua } Invoke-RestMethod -Method $Method -Uri $uri -Headers $headers ``` ### Technical Analysis The request helpers derive the destination directly from `ATREST_JIRA_BASE_URL` an ...[truncated 1987 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `ATREST_JIRA_BASE_URL` before creating any authorization header or request. 2. Require the `https` scheme and reject plaintext HTTP. 3. Compare the normalized origin against an explicit administrator-controlled allowlist of approved Jira tenant origins. 4. Reject embedded user information, fragments, unexpected ports, malformed hosts, and non-HTTPS schemes. 5. Do not permit a Jira task or untrusted prompt to modify the approved base URL dynamically. 6. Configure the HTTP client not to forward credentials across origins. For `curl`, use controls such as: ```bash curl \ --proto '=https' \ --max-redirs 0 \ --request "$method" \ --url "$url" ``` 7. If redirects are required, validate every redirect destination against the same approved origin before resending credentials. 8. Prefer a secret-aware Jira client that binds credentials to a preconfigured tenant rather than storing a reusable authorization header in a general-purpose shell variable. 9. Document that changes to the Jira origin are security-sensitive and require administrator approval. ]]>