T09 · Insecure Skill Coding Practices
- Location
scripts/videogen.py:92- Finding
API Credential Disclosure Through an Unvalidated Custom Base URL
- Content
View full analysis
Vulnerability Details
File Location:
scripts/videogen.py, lines 92–100, 130–143, and 587
Vulnerability Type: Unvalidated credential destination
Risk Level: HighVulnerable Code
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )python parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")Technical Analysis
The API destination can be supplied through the
--base-urlcommand-line argument, theAI_HIVE_BASE_URLenvironment variable, or thebase_urlfield in~/.ai-hive/config.json. The value is accepted without validating its scheme or hostname.The client subsequently attaches the AI Hive bearer credential to every request made through
_request(). Consequently, an attacker-controlled base URL receives theAuthorizationheader. The implementation also permits plain HTTP destinations, which can expose the credential to network interception.This is a destination-validation failure: a sensitive credential intended for AI Hive is not bound to an approved origin before transmission.
Attack Path
- An ...[truncated 1354 chars]
- Remediation
View remediation
Remediation Suggestions
-
Bind API credentials to the official origin by default:
- Permit only
https://ai-hive.iclip.cn/api. - Reject URLs with any other scheme, hostname, port, username, or password component.
- Permit only
-
If custom deployments must be supported:
- Require HTTPS.
- Maintain an explicit hostname allowlist.
- Require a separate credential for each custom origin.
- Require interactive confirmation before transmitting an AI Hive credential to a non-default origin.
- Clearly display the normalized destination hostname.
-
Parse URLs with
urllib.parse.urlparse()rather than relying on string concatenation. -
Reject malformed URLs, plain HTTP, embedded credentials, fragments, and unexpected ports.
-
Avoid attaching the authorization header globally. Construct it only after confirming that the request destination matches the credential's approved origin.
-
Add tests confirming that CLI, environment, and configuration-file overrides cannot route an AI Hive credential to an unapproved host.
-
If a credential may already have been exposed, revoke it, issue a replacement, and review account usage for unauthorized generation tasks.
-