T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/emr_qc_impl.py:53
- Finding
- Unrestricted API Endpoint Can Receive the App Key and Medical Record Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/emr_qc_impl.py:53-61`; endpoint configuration is exposed through `scripts/emr_qc.py:24-35` and `scripts/run.py:48-59` **Vulnerability Type**: Arbitrary outbound API destination and sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```python def make_llm_caller(appkey: str, base: str = DEFAULT_LLM_BASE, model: str = DEFAULT_LLM_MODEL, timeout: int = 0): """Return an llm(messages) → str calling function.""" url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} def llm(messages: List[Dict[str, str]]) -> str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The destination is directly configurable through the command-line entry points: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"Model base URL (default: {DEFAULT_LLM_BASE}).", ) ``` ### Technical Analysis The user-controlled `--base` value is used to construct the destination of an authenticated HTTP request without validating the scheme or hostname. The request includes both: - The HiVoice application key in the `Authorization: Bearer` header. - LLM messages containing patient-derived chief-complaint and present-illness data. The implementation does not require HTTPS and does not restrict the destination to the documented HiVoice host. Consequently, an attacker who can influence invocation arguments can redirect the request to an attacker-controlled HTTP or HTTPS server. Using an HTTP URL additionally exposes the bearer credential and medical data to network interception. This issue crosses a significant trust boundary because a credential intended for one service can be transmitted to an unrelated destination. ### Attack Path 1. The attacker gains the ability to influence the Skill invocation, deployment configuration, wrapper script, or ...[truncated 1443 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary endpoint configuration in production and use a fixed, trusted API endpoint. 2. If endpoint customization is operationally necessary: - Parse the URL with `urllib.parse.urlsplit`. - Require the `https` scheme. - Enforce an explicit hostname allowlist, such as `maas-api.hivoice.cn`. - Reject embedded credentials, unexpected ports, fragments, and ambiguous host representations. 3. Ensure redirects cannot forward authentication headers or medical data to a different origin. Prefer rejecting cross-origin redirects entirely. 4. Separate credentials by destination so a credential issued for HiVoice is never attached to requests for another host. 5. Store the application key in a protected environment variable or secret manager rather than routinely passing it in command-line arguments, which may be visible in process listings or shell history. 6. Add automated tests confirming that HTTP URLs, unapproved hosts, malformed URLs, and cross-origin redirects are rejected before any request is sent. 7. Minimize the transmitted record content and maintain the documented de-identification requirement. ]]>