T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/call_mood_api.py:16
- Finding
- Configurable API Origin Can Expose the Bearer Credential## Vulnerability Details **File Location**: `scripts/call_mood_api.py`, lines 16-26 **Vulnerability Type**: Unrestricted credential forwarding to a configurable network origin **Risk Level**: Medium **Vulnerable Code**: ```python BASE_URL = os.environ.get("BOTMOOD_URL", "https://moodspace.fun") API_KEY = os.environ.get("BOTMOOD_API_KEY", "") def make_request(endpoint: str, method: str = "GET", data: dict = None, auth: bool = True) -> dict: """发送 API 请求""" url = f"{BASE_URL}{endpoint}" headers = {"Content-Type": "application/json"} if auth and API_KEY: headers["Authorization"] = f"Bearer {API_KEY}" ``` ### Technical Analysis The script obtains the destination base URL directly from the `BOTMOOD_URL` environment variable without validating its scheme or host. For authenticated operations, it unconditionally attaches `BOTMOOD_API_KEY` to the resulting request as an HTTP bearer credential. Supporting custom deployments may justify a configurable endpoint, but forwarding a credential intended for MoodSpace to any configured origin exceeds the minimum privilege required for the declared functionality. An attacker who can influence the process environment or its launch configuration can redirect authenticated requests to an attacker-controlled server. The flaw does not independently grant the attacker the ability to modify the environment; exploitation requires such influence. HTTPS is used by the default URL, but the implementation does not require HTTPS for an overridden URL. Consequently, it can also send the bearer credential over plaintext HTTP if configured that way. ### Attack Path 1. An attacker gains the ability to influence the Skill's environment or launch configuration. 2. The attacker sets `BOTMOOD_URL` to an attacker-controlled endpoint, such as `https://attacker.example`. 3. The legitimate `BOTMOOD_API_KEY` remains present in the environment. 4. A user or Agent in ...[truncated 1215 chars]
- Remediation
- ## Remediation Suggestions 1. Fix the API origin to `https://moodspace.fun` when custom deployments are not required. 2. If configurability is necessary, parse the URL and enforce: - The `https` scheme. - An explicit allowlist of trusted hostnames. - An expected port. - No embedded username or password. - No fragments or unexpected path prefixes. 3. Associate each API credential with an explicit trusted origin and refuse to attach the `Authorization` header when the request origin differs. 4. Reject redirects to a different origin, or strip the authorization header before following any cross-origin redirect. 5. Fail closed on invalid configuration rather than silently sending unauthenticated or insecure requests. 6. Document that environment variables controlling network destinations are security-sensitive and must not be supplied by untrusted users. 7. Consider replacing arbitrary `BOTMOOD_URL` overrides with a small administrator-controlled allowlist, for example: ```python from urllib.parse import urlparse DEFAULT_ORIGIN = "https://moodspace.fun" ALLOWED_HOSTS = {"moodspace.fun"} configured_url = os.environ.get("BOTMOOD_URL", DEFAULT_ORIGIN).rstrip("/") parsed = urlparse(configured_url) if ( parsed.scheme != "https" or parsed.hostname not in ALLOWED_HOSTS or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise ValueError("BOTMOOD_URL must use an approved HTTPS origin") BASE_URL = configured_url ```