T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_agentmemory.py:48- Finding
Bearer Token Exposure Through Unvalidated HTTP Redirects
- Content
View full analysis
tuple[bool, str]: target = f"{url.rstrip('/')}{path}" req = urllib.request.Request(target, headers={}) secret = os.environ.get("AGENTMEMORY_SECRET") if send_secret else None if secret: req.add_header("Authorization", f"Bearer {secret}") try: with urllib.request.urlopen(req, timeout=timeout) as res: body = res.read(4096).decode("utf-8", errors="replace") return 200 <= res.status < 300, f"HTTP {res.status}: {body[:240]}" ``` The authenticated probe is enabled as follows: ```python send_secret = bool(os.environ.get("AGENTMEMORY_SECRET")) and can_send_secret(args.url) if os.environ.get("AGENTMEMORY_SECRET") and not send_secret: results.append({"area": "security", "status": "warn", "message": "AGENTMEMORY_SECRET is set for non-loopback HTTP; refusing to send it without HTTPS"}) for endpoint in ("/agentmemory/livez", "/agentmemory/health"): ok, message = probe(args.url, endpoint, args.timeout, send_secret) ``` ### Technical Analysis The script validates only the initial user-supplied URL before adding the `Authorization: Bearer` header. It permits authenticated requests when the original URL uses HTTPS or loopback HTTP. However, `urllib.request.urlopen` follows supported HTTP redirects automatically. The script does not install a restrictive redirect handler, validate the redirect destination, enforce same-origin redirects, or remove the authorization header when the destination changes. Consequently, a server trusted for the initial request can redirect the probe to another origin, where the bearer credential may be disclose ...[truncated 2389 chars]- Remediation
View remediation