T09 · Insecure Skill Coding Practices
- Location
scripts/imagegen.py:94- Finding
Caller-Controlled API Endpoint Can Receive the AI-HIVE Bearer Credential
- Content
View full analysis
Vulnerability Details
File Location:
scripts/imagegen.py:94-99, 128-143, 587;scripts/videogen.py:94-99, 128-143, 587
Vulnerability Type: Arbitrary authenticated endpoint selection and credential disclosure
Risk Level: HighVulnerable Code
The following implementation is duplicated in both
scripts/imagegen.pyandscripts/videogen.py:python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}" def _request(self, method, url, **kwargs): self.config.log(f"{method} {url}") try: resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )python parser.add_argument("--base-url", help=f"API Base URL (default {DEFAULT_BASE_URL})")Technical Analysis
The API base URL can be supplied through the
--base-urlcommand-line option, theAI_HIVE_BASE_URLenvironment variable, or the local configuration file. The code performs no validation of the URL scheme or destination hostname before attaching the AI-HIVE bearer credential to requests.Consequently, an attacker who can influence a copied command, process environment, wrapper script, or configuration file can direct authenticated requests to an attacker-controlled endpoint. The first request sent through the resulting
AiHiveClientdiscloses the ...[truncated 1521 chars]- Remediation
View remediation
Remediation Suggestions
- Remove runtime base-URL overrides from production distributions when custom endpoints are not operationally required.
- If overrides are required for development, place them behind an explicit option such as
--allow-unsafe-custom-endpoint. - Before constructing an authenticated client, parse the URL and require:
- The
httpsscheme. - An exact allowlisted hostname.
- An expected port.
- No embedded username or password.
- The
- Scope the bearer credential to the official AI-HIVE origin and refuse to attach it to any other destination.
- Disable HTTP redirects for authenticated API requests, or validate the destination of every redirect before following it.
- Treat configuration-file changes as security-sensitive and reject untrusted endpoint values even if they were previously stored.
- Add automated tests proving that HTTP URLs, lookalike domains, subdomain suffix tricks, IP literals, and non-allowlisted hosts are rejected.