T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run.py:103
- Finding
- Arbitrary API Endpoint Can Receive Bearer Credentials and Sensitive Medical Records<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:103-118`, with the user-controlled endpoint introduced at `scripts/run.py:235` and passed to the request at `scripts/run.py:285-293` **Vulnerability Type**: Unrestricted transmission of credentials and sensitive data to a configurable endpoint **Risk Level**: High ### Vulnerable Code ```python req = Request( api_url, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": f"Bearer {appkey}", }, ) resp = urlopen(req, timeout=timeout) body = json.loads(resp.read().decode("utf-8")) ``` The endpoint is directly configurable through a command-line argument: ```python p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI compatible endpoint URL") ``` The unvalidated value is subsequently passed into the network request: ```python out["answer"] = call_llm( api_url=args.api_url, model=args.model, appkey=args.appkey, system_prompt=args.system_prompt, user_prompt=user_prompt, temperature=float(args.temperature), timeout=int(args.timeout), ) ``` ### Technical Analysis The `--api-url` option accepts an arbitrary URL without validating its scheme or destination hostname. `call_llm()` then sends both the complete user prompt and the supplied API credential to that URL. The prompt is expected to contain insurance claims and medical-record information, potentially including sensitive health or identity data. No control enforces HTTPS, restricts requests to the documented internal API hostname, or prevents forwarding a production bearer credential to an untrusted destination. Consequently, anyone able to influence the command invocation—such as through an unsafe wrapper, automation configuration, copied command, or deployment setting—can redirect these sensitive values to an attacker-controlled server. The application documentation advises callers to anonymize ...[truncated 1866 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict outbound requests to an explicit allowlist of approved HTTPS hosts, including the documented internal API hostname. 2. Reject plaintext `http://` endpoints whenever credentials or medical data are transmitted. 3. Parse the URL with `urllib.parse.urlsplit()` and validate the normalized scheme, hostname, and port before constructing the request. 4. Disable arbitrary endpoint overrides in production. If development overrides are required, place them behind an explicit unsafe-development flag and never forward production credentials in that mode. 5. Load the API key from a protected environment variable, secret manager, or restricted configuration file rather than a command-line argument, because command-line values may be exposed through process listings or job logs. 6. Use separate, narrowly scoped, short-lived credentials for development and production endpoints. 7. Add a confirmation or policy check before transmitting records outside the approved internal domain. 8. Add automated tests confirming that unapproved hosts, redirects to unapproved hosts, plaintext HTTP URLs, malformed URLs, and unexpected ports are rejected. 9. Review redirect behavior and either disable redirects or revalidate every redirect target before forwarding authorization headers. 10. Apply technical redaction or validation for expected sensitive identifiers instead of relying exclusively on callers to anonymize records. ]]>