T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:105
- Finding
- Unrestricted API Endpoint Can Expose Bearer Credentials and Sensitive Medical Data## Vulnerability Details **File Location**: `scripts/run.py:105-112`, `scripts/run.py:225`, `scripts/run.py:238-244`, and `scripts/run.py:282-290` **Vulnerability Type**: Unrestricted outbound endpoint and insecure command-line credential handling **Risk Level**: High ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) ``` ```python p.add_argument("--appkey", default="", help="Internal medical model authentication key.") p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI-compatible endpoint URL") ``` ```python if not args.appkey: print("error: non-dry-run execution requires --appkey", file=sys.stderr) return 2 out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=system_prompt_for(task_key, args.system_prompt), user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` option accepts an unrestricted user-supplied URL. The value is passed directly to `urllib.request.Request`, and the request includes both the bearer credential in the `Authorization` header and the complete user question in the JSON body. The implementation does not require HTTPS, validate the destination hostname, or restrict the endpoint to a trusted allowlist. Consequently, an HTTP endpoint can receive the credential and medical content in plaintext, while an attacker-controlled HTTPS endpoint can directly collect both values. The API credential is also supplied through `--appkey`. Command-line arguments can be exposed through process inspection facilities and may be retained in shell history when entered interactively. This inc ...[truncated 1723 chars]
- Remediation
- ## Remediation Suggestions 1. Remove unrestricted endpoint selection in production, or enforce an explicit allowlist of approved HTTPS schemes, hostnames, and ports. 2. Reject non-HTTPS URLs before constructing the request. Normalize and parse URLs with `urllib.parse.urlsplit` rather than validating them through string-prefix checks. 3. Prevent redirects to unapproved destinations, or validate every redirect target before forwarding any request containing credentials. 4. Load the API key from a protected environment variable, operating-system credential store, or secrets manager instead of accepting it as a command-line argument. 5. If interactive credential entry is necessary, use a non-echoing input mechanism such as `getpass`. 6. Use a dedicated, least-privileged API credential with limited scope, quota, and lifetime. Rotate the current credential if it may have been exposed. 7. Clearly warn operators that medical input is transmitted to the configured external service and require de-identification before submission. 8. Add automated tests confirming that plaintext HTTP, unapproved hosts, and redirects to unapproved hosts are rejected before the authorization header or request body is transmitted.