T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:45
- Finding
- Unrestricted LLM Endpoint Override Exposes API Credentials and Sensitive Health Data## Vulnerability Details **File Location**: `scripts/run.py`, lines 45–49, 207, and 221 **Vulnerability Type**: Server-Side Request Forgery and sensitive-data disclosure through an unrestricted API endpoint **Risk Level**: High **Vulnerable code:** ```python def make_llm_caller(appkey: str, base: str = DEFAULT_LLM_BASE, model: str = DEFAULT_LLM_MODEL, timeout: int = 0): url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} def llm(messages: List[Dict[str, str]]) -> str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` ```python parser.add_argument("--base", default=DEFAULT_LLM_BASE, help=f"Internal LLM base URL (default: {DEFAULT_LLM_BASE}).") ``` ```python llm = make_llm_caller(args.appkey, args.base, args.model, args.timeout) ``` ### Technical Analysis The command-line `--base` value is used directly to construct the request destination without validating its scheme, hostname, port, or network range. The application then sends an `Authorization: Bearer` header containing the supplied platform credential to that destination. The request body also contains the complete health record submitted for chronic-disease screening. Consequently, any party able to control or influence the command-line arguments can redirect the request to an attacker-controlled server or an unintended internal service. Both HTTP and HTTPS destinations are accepted, so the credential and medical data may also be sent over an unencrypted connection. This violates destination-bound credential handling and least-disclosure principles. ### Attack Path 1. An attacker gains control over, or influences, the arguments used to invoke the Skill. 2. The attacker sets `--base` to a server under their control, such as `https://attacker.example/v1`, or to an unencrypted HTTP endpoint. 3. The applicati ...[truncated 1159 chars]
- Remediation
- ## Remediation Suggestions - Remove the `--base` override from production builds if endpoint customization is unnecessary. - Otherwise, enforce a strict allowlist of approved API hostnames and ports. Parse the URL with `urllib.parse.urlsplit` and reject user-info components, fragments, unexpected paths, nonstandard ports, and all schemes except HTTPS. - Resolve the destination and reject loopback, link-local, private, multicast, reserved, and metadata-service address ranges unless a specifically approved internal endpoint requires them. Revalidate redirects or disable cross-origin redirects. - Attach the bearer credential only after confirming that the final request destination is an approved origin. Never forward credentials across redirects to another host. - Use endpoint-specific, short-lived, least-privilege credentials so one leaked key cannot access unrelated services. - Redact or minimize health information before transmission and obtain appropriate authorization for external processing. - Add automated tests confirming that attacker-controlled domains, plain HTTP URLs, embedded credentials, alternate ports, redirect-based bypasses, and internal IP literals are rejected.