T09 · Insecure Skill Coding Practices
Error
- Location
scripts/emr_qc_impl.py:54- Finding
Attacker-Controlled API Endpoint Can Exfiltrate the Bearer Key and Medical Data
- Content
View full analysis
str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The endpoint is exposed directly as a command-line option: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"大模型 base URL（默认：{DEFAULT_LLM_BASE}）。", ) ``` ### Technical Analysis The `--base` argument is accepted without validating its scheme, hostname, port, or resolved network address. The application appends `/chat/completions` to this value and sends an HTTP POST request containing: - The API key in an `Authorization: Bearer` header. - Medical record content in the chat-completions payload. - The selected model and prompt instructions. The code does not require HTTPS, restrict the destination to the intended HiVoice service, prevent requests to private or loopback addresses, or explicitly prevent cross-origin redirects. Therefore, a malicious invocation or unsafe wrapper can redirect credentials and patient-derived data to an attacker-controlled endpoint. Because arbitrary URLs can be supplied, the behavior also provides a limited server-side request forgery primitive in environments where the program has access to internal services. ### Attack Path 1. An attacker persuades a user, automation system, or deployment configuration to invoke the Skil ...[truncated 1307 chars]- Remediation
View remediation