T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/wan-image-gen.js:581
- Finding
- API Credential Disclosure Through an Unrestricted Endpoint Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wan-image-gen.js:467-490, 581-585` **Vulnerability Type**: Unrestricted credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```js async function createTask(baseUrl, apiKey, request) { const result = await requestJson(`${baseUrl}${request.endpoint}`, { method: 'POST', headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', 'X-DashScope-Async': 'enable' }, body: JSON.stringify(request.body) }); ``` ```js async function fetchTask(baseUrl, apiKey, taskId) { return requestJson(`${baseUrl}/api/v1/tasks/${encodeURIComponent(taskId)}`, { method: 'GET', headers: { Authorization: `Bearer ${apiKey}` } }); } ``` ```js const apiKey = firstNonEmpty(process.env.DASHSCOPE_API_KEY, config.apiKey); const baseUrl = String( firstNonEmpty(process.env.DASHSCOPE_BASE_URL, config.baseUrl, DEFAULT_BASE_URL) ).replace(/\/$/, ''); ``` ### Technical Analysis Sending the API key and image prompt to the official DashScope service is necessary for the declared image-generation functionality. However, the destination receiving these sensitive values is not restricted to the official service. The script accepts `baseUrl` from either `DASHSCOPE_BASE_URL` or `config.json` and performs no URL parsing, HTTPS enforcement, hostname allowlisting, port validation, or embedded-credential rejection. The same DashScope API key is then unconditionally placed in an `Authorization: Bearer` header for requests to that destination. This crosses the minimum required privilege boundary: endpoint configurability does not require granting every configured destination access to the DashScope credential. A malicious or mistakenly configured HTTP endpoint can receive both the API key and submitted prompt data. Plain HTTP also permits network interception. ### Attack Path 1. An attacker gains the ability to influence the process ...[truncated 1258 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the configured endpoint using the standard `URL` class and reject malformed URLs. 2. Require `https:` for all credential-bearing requests. 3. Allowlist the documented DashScope hostnames and permitted regional endpoints. 4. Reject embedded usernames or passwords, fragments, unexpected ports, and hostnames that resolve to loopback, private, link-local, or reserved addresses. 5. If custom endpoints are operationally necessary, require an explicit unsafe opt-in rather than enabling them through ordinary configuration. 6. Use a separate credential specifically scoped to each custom endpoint; never forward the DashScope key to an unrelated destination. 7. Revalidate the destination immediately before sending the bearer token to reduce DNS rebinding risk. 8. Document that changing the endpoint changes the party receiving prompts and credentials. 9. Prefer reading the key from the environment or a protected secret provider instead of plaintext `config.json`. ]]>