T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/emr_qc_impl.py:54
- Finding
- Attacker-Controlled API Endpoint Can Exfiltrate the Bearer Key and Medical Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/emr_qc_impl.py:54-62`; user-controlled configuration originates from `scripts/emr_qc.py:24-27` and `scripts/run.py:50-53` **Vulnerability Type**: Unvalidated outbound request destination and sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```python def make_llm_caller(appkey: str, base: str = DEFAULT_LLM_BASE, model: str = DEFAULT_LLM_MODEL, timeout: int = 0): """返回一个 llm(messages) → str 的调用函数。""" url = f"{base.rstrip('/')}/chat/completions" headers = {"Authorization": f"Bearer {appkey}"} def llm(messages: List[Dict[str, str]]) -> str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The endpoint is exposed directly as a command-line option: ```python parser.add_argument( "--base", default=DEFAULT_LLM_BASE, help=f"大模型 base URL（默认：{DEFAULT_LLM_BASE}）。", ) ``` ### Technical Analysis The `--base` argument is accepted without validating its scheme, hostname, port, or resolved network address. The application appends `/chat/completions` to this value and sends an HTTP POST request containing: - The API key in an `Authorization: Bearer` header. - Medical record content in the chat-completions payload. - The selected model and prompt instructions. The code does not require HTTPS, restrict the destination to the intended HiVoice service, prevent requests to private or loopback addresses, or explicitly prevent cross-origin redirects. Therefore, a malicious invocation or unsafe wrapper can redirect credentials and patient-derived data to an attacker-controlled endpoint. Because arbitrary URLs can be supplied, the behavior also provides a limited server-side request forgery primitive in environments where the program has access to internal services. ### Attack Path 1. An attacker persuades a user, automation system, or deployment configuration to invoke the Skil ...[truncated 1307 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require `https` for all production endpoints. 2. Allowlist the exact intended API hostname, such as `maas-api.hivoice.cn`, rather than accepting arbitrary destinations. 3. Reject URLs containing embedded credentials, fragments, unexpected ports, or non-HTTP schemes. 4. Resolve the hostname and reject loopback, private, link-local, multicast, and otherwise reserved addresses unless an explicitly trusted internal deployment requires them. 5. Disable redirects or verify every redirect destination against the same scheme and hostname policy before forwarding the authorization header. 6. If custom endpoints are operationally necessary, place them behind an explicit opt-in configuration reserved for trusted administrators and do not expose the option to untrusted callers. 7. Use separate, narrowly scoped credentials for each approved provider and deployment. 8. Clearly warn users before transmitting medical data and ensure the destination complies with the applicable privacy and retention requirements. ]]>