T09 · Insecure Skill Coding Practices
Error
- Location
- references/HTTP-REQUESTS.md:4
- Finding
- Environment-Controlled API Endpoint Can Disclose Credentials and Document Contents<![CDATA[ ## Vulnerability Details **File Location**: `references/HTTP-REQUESTS.md:4-8` **Vulnerability Type**: Unvalidated destination URL for authenticated requests **Risk Level**: High ### Vulnerable Code ```sh curl -sS -X POST "${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1/pdf-analysis/pdf.analyze" \ -H "Authorization: Bearer ${PDF_ANALYSIS_API_KEY}" \ -H "Idempotency-Key: $(python3 -c 'import uuid; print(uuid.uuid4())')" \ -H "Content-Type: application/json" \ --data-binary @request.json ``` A second authenticated request uses the same environment-controlled origin at `references/HTTP-REQUESTS.md:15-16`: ```sh curl -sS "${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1/pdf-analysis/pdf.analyze/tasks/任务ID" \ -H "Authorization: Bearer ${PDF_ANALYSIS_API_KEY}" ``` ### Technical Analysis The request destination is taken from `AI_SKILLS_API_URL` without validating its scheme or hostname. Although a legitimate HTTPS endpoint is the default, any existing value of the environment variable overrides that endpoint. The command forwards the `PDF_ANALYSIS_API_KEY` bearer credential to the selected destination. The task creation request also sends `request.json`, which is documented as containing filenames, page numbers, and extracted PDF text. Consequently, control over the environment variable is sufficient to redirect both authentication material and document contents to an unintended server. This does not grant an attacker arbitrary command execution by itself. Exploitation requires the ability to influence the environment or configuration from which the documented command is executed. ### Attack Path 1. An attacker or compromised launcher sets `AI_SKILLS_API_URL` to an attacker-controlled HTTP or HTTPS origin. 2. A user or agent follows the documented request procedure without inspecting the inherited variable. 3. Shell expansion substitutes the attacker-controlled origin into the `curl` command. 4. `curl` sends the `A ...[truncated 859 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a fixed, trusted HTTPS API origin whenever endpoint customization is not strictly required. 2. If customization is necessary, parse and validate the URL before use: - Require the `https` scheme. - Permit only explicitly approved hostnames. - Reject embedded credentials, fragments, unexpected ports, and noncanonical host representations. 3. Configure `curl` to reject insecure protocols, for example with `--proto '=https'`. 4. Do not forward authorization headers across cross-origin redirects. Prefer disabling redirects; if redirects are necessary, validate every destination. 5. Run requests from a sanitized environment rather than implicitly trusting inherited variables. 6. Document the security consequences of overriding the API origin. 7. Use narrowly scoped, revocable API keys and rotate a key immediately if it may have been sent to an untrusted endpoint. ]]>