T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:110
- Finding
- Unrestricted API Endpoint Can Expose Credentials and Sensitive Medical Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:110-119`, `scripts/run.py:218`, and `scripts/run.py:269-277` **Vulnerability Type**: Unrestricted outbound endpoint and credential disclosure **Risk Level**: High ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) ``` The destination is supplied through an unrestricted command-line argument: ```python p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI 兼容接口地址") ``` The application then passes that value directly to `call_llm`: ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=system_prompt_for(task_key, args.system_prompt), user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` argument accepts an arbitrary URL without validating its scheme, hostname, port, or resolved network address. The selected endpoint receives an `Authorization: Bearer` header containing the model API key, as well as the complete system prompt and user question. An attacker who can influence command-line parameters or an integration's configuration can redirect the request to an attacker-controlled HTTP server. Because HTTPS is not enforced, the caller can also select a plaintext HTTP endpoint, exposing credentials and medical content to network interception. The unrestricted URL can additionally cause server-side requests to loopback or private-network addresses. Although successful processing expects a JSON response containing `choices`, the outbound request itself occurs before response validation. This means the endpoint still receives the request and its sensitive payload. ### Attack Path 1. An attacker gains ...[truncated 1270 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict endpoints to an explicit allowlist of approved hostnames. 2. Require the `https` scheme and reject plaintext HTTP URLs. 3. Resolve the hostname and reject loopback, link-local, private, multicast, and otherwise prohibited network addresses unless explicitly required. 4. Disable redirects, or validate the scheme, hostname, and resolved address after every redirect before forwarding credentials. 5. Do not attach the authorization header until the destination has passed all validation. 6. Separate credentials by destination so a credential issued for the default provider is never forwarded to another host. 7. If custom endpoints are a necessary feature, require an explicit administrative opt-in and display a warning that prompts and credentials will be transmitted to that destination. 8. Add automated tests covering non-HTTPS URLs, unapproved hosts, private addresses, encoded IP representations, DNS rebinding scenarios, and redirects to prohibited destinations. 9. Require callers to de-identify medical data before submission and document the approved data-handling boundary. ]]>