T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:85- Finding
Unvalidated Custom API Endpoint Can Receive the Bearer Credential
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py, lines 85–121
Vulnerability Type: Unrestricted credential forwarding to a configurable endpoint
Risk Level: MediumVulnerable Code
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The API base URL can be supplied through the
--base-urlargument, theAI_HIVE_BASE_URLenvironment variable, or the local configuration file. The value is accepted without validating its scheme or destination host.The HTTP client subsequently attaches the AI Hive API key as an
Authorization: Bearerheader to every request made through that base URL. Consequently, any party capable of influencing one of the base URL configuration sources can redirect authenticated requests to an arbitrary server. The code also permits a plaintext HTTP endpoint, which could expose the credential to network interception.This behavior is especially sensitive because changing a base URL can appear to be an ordinary configuration operation while silently changing the recipient of a reusable credential.
Attack Pat
...[truncated 1321 chars]
- Remediation
View remediation
Remediation Suggestions
- Require the API base URL to use HTTPS.
- Allowlist the expected production host,
ai-hive.iclip.cn, before attaching the bearer credential. - Reject URLs containing user information, fragments, unexpected ports, or non-HTTP schemes.
- If custom endpoints are a legitimate requirement, require an explicit high-friction option such as
--allow-custom-api-hostand display the exact credential recipient before proceeding. - Construct authentication headers only after validating the destination. Do not automatically forward production credentials to arbitrary custom hosts.
- Consider maintaining separate credentials for development or self-hosted endpoints.
- Add automated tests covering HTTP URLs, deceptive subdomains, embedded user information, malformed URLs, redirects, and unapproved hosts.
- Disable cross-origin credential forwarding during redirects or reject redirects to a different origin.
- Advise affected users to revoke and rotate keys if an untrusted base URL may previously have been configured.