T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:76
- Finding
- Unrestricted API Endpoint Can Disclose Credentials and Medical Data## Vulnerability Details **File Location**: `scripts/run.py`, lines 76–82, with attacker-controlled configuration accepted at line 204 and passed to the request at lines 260–268 **Vulnerability Type**: Unrestricted transmission of credentials and sensitive data to a user-configurable endpoint **Risk Level**: High ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) ``` The endpoint is exposed as an unrestricted command-line argument: ```python p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI compatible endpoint URL") ``` The unvalidated value and sensitive inputs are then passed to `call_llm`: ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=args.system_prompt, user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` argument permits an arbitrary URL, but the program does not validate its scheme, hostname, port, resolved IP address, or redirect destination. `call_llm` sends an `Authorization: Bearer` header containing the supplied API key and a JSON body containing the complete medical question to this destination. Consequently, an attacker who controls the command invocation, configuration, wrapper script, or instructions copied by a user can redirect the request to an attacker-controlled endpoint. That endpoint receives both the credential and the potentially sensitive clinical content. The unrestricted URL also creates a server-side request forgery-like primitive in execution environments where the skill has access to internal or loopback services. Actual access remains limited to destinations reachable with the process's existing network privileges. Re ...[truncated 1920 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--api-url` if endpoint customization is not a strict functional requirement, and use only the trusted constant endpoint. 2. If customization is required, validate the parsed URL before constructing the request: - Require the `https` scheme. - Permit only explicitly approved hostnames and ports. - Reject URLs containing embedded credentials. - Reject loopback, link-local, private, multicast, reserved, and unspecified IP destinations unless explicitly required. 3. Resolve the hostname and verify every resolved address against the network policy. Account for DNS rebinding by validating the destination used for the actual connection. 4. Disable automatic redirects or validate each redirect target against the same scheme, hostname, port, and IP allowlist. 5. Ensure the `Authorization` header is never forwarded when a redirect changes the origin. 6. Separate credentials by endpoint. Do not send a production API key to any endpoint other than the service for which it was issued. 7. Add automated tests confirming rejection of: - Plain HTTP URLs. - Unapproved external hosts. - Loopback and private-network addresses. - Redirects to unapproved destinations. - URLs with embedded credentials. 8. Continue instructing users to de-identify medical content, but do not rely on documentation as the primary control; enforce trusted destinations in code. 9. Revoke and rotate any API key that may previously have been transmitted to an untrusted endpoint.