T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/imagegen.py:91
- Finding
- Stored API Key Can Be Redirected to an Untrusted Base URL## Vulnerability Details **File Location**: `scripts/imagegen.py`, lines 91–99 and 125–145 **Vulnerability Type**: Credential disclosure through an unrestricted API endpoint override **Risk Level**: Medium **Vulnerable Code**: ```python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URL ``` ```python class AiHiveClient: """Encapsulates AI Hive OpenAPI HTTP calls.""" def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs ) ``` ### Technical Analysis The API key and API base URL are resolved independently. The key may be loaded from the persistent configuration file at `~/.ai-hive/config.json`, while the destination can be overridden through either the `AI_HIVE_BASE_URL` environment variable or the `--base-url` command-line argument. The client unconditionally includes the API key in the `Authorization` header for requests sent to the selected base URL. No validation enforces HTTPS, checks that the hostname is the expected AI Hive service, or requests confirmation before reusing a stored credential with a different origin. An attacker capable of influencing the process environment or command invocat ...[truncated 1517 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict authenticated requests to the expected HTTPS origin by default: - Require the `https` scheme. - Compare the normalized hostname against an explicit allowlist. - Reject URLs containing unexpected credentials, ports, or malformed hostnames. 2. If custom API endpoints are necessary, require an explicit high-friction opt-in and display the exact destination before sending credentials. 3. Bind stored credentials to their configured origin. Do not automatically send a key loaded for `ai-hive.iclip.cn` to a different hostname. 4. Prefer a separate API key argument or configuration profile for each custom endpoint. 5. Reject plain HTTP endpoints except for an explicitly enabled local-development mode, and never reuse production credentials in that mode. 6. Add automated tests confirming that environment and CLI overrides cannot redirect a stored credential without explicit authorization. 7. Document the security implications of `AI_HIVE_BASE_URL` and `--base-url`.