T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:91- Finding
AI-HIVE API Key Can Be Sent to an Arbitrary Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py:91-98, 126-143
Vulnerability Type: Arbitrary authenticated API endpoint
Risk Level: HighVulnerable Code
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The image-generation client accepts its API base URL from the
--base-urlcommand-line option, theAI_HIVE_BASE_URLenvironment variable, or the persistent configuration file. It does not require HTTPS, validate the destination hostname, or prevent credentials from being attached to requests sent to a non-AI-HIVE origin.The client then unconditionally includes the AI-HIVE API key in the
Authorizationheader for requests constructed from that configurable base URL. Consequently, control over any base-URL input is sufficient to redirect the bearer credential to an attacker-controlled HTTP server.This behavior exceeds the minimum privilege required for the declared integration, which identifies
https://ai-hive.iclip.cn/apias the service endpoint.Attack Path
- An attacker influences the execution environment, com ...[truncated 1246 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove runtime base-URL overrides if custom AI-HIVE deployments are not a documented requirement.
- Allowlist the expected origin, such as
https://ai-hive.iclip.cn, before attaching an API key. - Require HTTPS and reject URLs containing credentials, fragments, unexpected ports, or non-HTTP schemes.
- Compare a parsed URL's normalized scheme, hostname, and port against an explicit trusted-origin list.
- Never attach the AI-HIVE bearer credential when the request origin differs from the approved API origin.
- If custom endpoints are necessary, require a separate credential for each endpoint and an explicit interactive confirmation before first use.
- Treat environment and configuration-file endpoint changes as security-sensitive and display the destination origin before authenticated requests.
- Add automated tests confirming that HTTP URLs and unapproved hosts are rejected before any network request is made.