T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:60- Finding
API Key Disclosure Through an Unrestricted Custom Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py:60-99, 130-143; duplicated inscripts/videogen.py:60-99, 130-143
Vulnerability Type: Credential disclosure through an attacker-controlled API endpoint
Risk Level: HighVulnerable Code
python def __init__(self, api_key=None, base_url=None, verbose=False): self.verbose = verbose self.api_key = self._resolve_api_key(api_key) self.base_url = self._resolve_base_url(base_url) def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The scripts obtain the API base URL from a command-line argument, the
AI_HIVE_BASE_URLenvironment variable, or the persistent configuration file. No validation requires HTTPS or restricts the destination to the legitimate AI-HIVE hostname.The client subsequently attaches the AI-HIVE bearer token to every request sent to that destination. Consequently, anyone able to influence command arguments, environment variables, or
~/.ai-hive/config.jsoncan redirect authenticated requests to an endpoint they control.This behavior exceeds the minimum privil ...[truncated 1755 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove end-user base URL overrides unless custom endpoints are a documented and necessary feature.
- Allowlist the canonical origin, including scheme and hostname:
- Scheme:
https - Hostname:
ai-hive.iclip.cn - Expected API path prefix:
/api
- Scheme:
- Reject URLs containing user information, fragments, unexpected ports, or hostnames that merely end with a trusted-looking suffix.
- Never attach the AI-HIVE token to a destination that has not passed origin validation.
- If custom deployments must be supported, use a separate credential for each endpoint and require explicit interactive confirmation before sending credentials to a new origin.
- Reject plaintext HTTP, including for custom endpoints.
- Apply the same correction to
scripts/imagegen.pyandscripts/videogen.py. - Add tests proving that command-line, environment, and configuration-file values cannot redirect the bearer token to an unauthorized host.
- Rotate any API key that may already have been used while an untrusted base URL was configured.