T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:171
- Finding
- Configurable API Endpoint Can Exfiltrate Bearer Credentials and Medical Data## Vulnerability Details **File Location**: `scripts/run.py:171-180` and `scripts/run.py:264-268` **Vulnerability Type**: Unrestricted transmission of credentials and sensitive data to a user-controlled endpoint **Risk Level**: High ### Vulnerable Code ```python def call_llm(prompt: str, *, base: str, model: str, appkey: str, timeout: int) -> str: """Call the internal medical large language model.""" url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} if appkey else {} payload = { "model": model, "messages": [{"role": "user", "content": prompt}], "temperature": 0, } response = _http_post(url, payload, headers, timeout=timeout) ``` The destination is exposed as an unrestricted command-line argument: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"Internal model base URL (default: {DEFAULT_LLM_BASE}).", ) ``` ### Technical Analysis The `--base` argument controls the URL to which `call_llm()` sends requests. The application unconditionally attaches the supplied API key as a Bearer credential and includes the processed patient dialogue in the request body. The implementation does not enforce HTTPS, validate the destination hostname against an allowlist, constrain the port, or prevent credentials from being forwarded through redirects. Consequently, any party capable of controlling the command invocation or configuration can replace the intended medical-model endpoint with an attacker-controlled server. Although endpoint configurability may be operationally useful, coupling an unrestricted endpoint with automatic credential forwarding violates the principle that credentials must be scoped to a trusted origin. ### Attack Path 1. An attacker influences the command invocation, wrapper script, deployment configuration, or user instructions. 2. The attacker sets `--base` to a ...[truncated 955 chars]
- Remediation
- ## Remediation Suggestions 1. Remove runtime endpoint configurability if only the documented service is supported. 2. If multiple endpoints are required, validate the normalized hostname and port against an explicit allowlist. 3. Require HTTPS and reject plaintext HTTP endpoints. 4. Disable redirects, or independently validate every redirect destination before forwarding credentials. 5. Bind credentials to specific service origins and never attach the API key to an unapproved host. 6. Consider obtaining the key from a protected environment variable or secret manager rather than a command-line argument, which may be visible in process listings and shell history. 7. Add automated tests confirming that HTTP URLs, unknown hosts, deceptive subdomains, embedded user information, and redirects to untrusted hosts are rejected. 8. Minimize or redact patient information before transmission and record approved data-processing destinations in the privacy documentation.