T09 · Insecure Skill Coding Practices
- Location
lib/config.js:2- Finding
Unvalidated destination override can disclose authentication credentials and lead data
- Content
View full analysis
Vulnerability Details
File Location:
lib/config.js:2-11,lib/auth.js:19-24,lib/apiClient.js:32-42,lib/apiClient.js:68-78
Vulnerability Type: Unrestricted credential-bearing network destination
Risk Level: HighVulnerable Code
lib/config.js:2-11:js export const DOMAIN = process.env.HAWKEYE_LEAD_DOMAIN || "hawkeye-luren33.devops.sl.beta.xiaohongshu.com"; export const COOKIE_NAME = process.env.HAWKEYE_LEAD_COOKIE_NAME || `access-token-${DOMAIN}`; export const BASE_URL = `https://${DOMAIN}`;lib/auth.js:19-24:js function readAmbientSsoToken() { if (!fs.existsSync(AMBIENT_SSO_FILE)) return null; try { const data = JSON.parse(fs.readFileSync(AMBIENT_SSO_FILE, "utf8")); return data[`common-internal-access-token-${AMBIENT_SSO_TIER}`] || null;lib/apiClient.js:32-42:js export function buildRequest(entry, bodyObj) { const token = getToken(); const headers = { "Content-Type": "application/json" }; if (token) { headers.Cookie = `${COOKIE_NAME}=${token}`; } return { method: entry.method, url: `${BASE_URL}${entry.path}`, headers, bodyObj, }; }lib/apiClient.js:68-78:js const { method, url, headers } = buildRequest(entry, bodyObj); let response; try { response = await fetch(url, { method, headers, body: JSON.stringify(bodyObj ?? {}), }); } catch (err) {Technical Analysis
The
HAWKEYE_LEAD_DOMAINenvironment variable controls the complete network destination without hostname validation or an allowlist. Every API request attaches either the manually configured browser token or the shared ambient SSO token as a Cookie header.Consequently, HTTPS only protects transport to the selected host; it does not establish that the host is an authorized Hawkeye service. If an attacker or compromised launcher can influence the CLI envir ...[truncated 1869 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse the destination using the standard
URLAPI and reject malformed values. - Require the
https:scheme. - Enforce an exact allowlist of approved Hawkeye hosts. If suffix matching is unavoidable, use strict DNS-label boundary checks rather than substring matching.
- Do not attach credentials when the destination differs from the built-in approved host unless the alternate host has been explicitly configured in a trusted policy file.
- Never send a shared ambient SSO token to an environment-variable override.
- Remove the ambient-token fallback until acceptance by the intended production gateway has been verified and documented.
- Maintain separate credentials for test and production environments and bind each credential to an exact approved hostname.
- Consider rejecting
HAWKEYE_LEAD_COOKIE_NAMEoverrides or validating them against an explicit per-host mapping. - Add automated tests proving that attacker-owned hosts, lookalike suffixes, embedded ports, user-info syntax, and malformed domains are rejected.
- Rotate potentially exposed tokens if the CLI has previously run with an untrusted environment.
- Parse the destination using the standard