GHSA-8cp3-qxj6-px34 utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion

• PyPI utcp-http: < 1.1.4 → fixed in 1.1.4

Summary The `utcp-http` library ( str: client_id = auth_details.client_id + ensure_secure_url(auth_details.token_url, context="OAuth2 token fetch") ``` Impact This is a Server-Side Request Forgery (SSRF) / Credential Theft vulnerability. Any application that: 1. uses `utcp-http` to register OpenAPI specifications from sources not fully controlled by the operator, and 2. configures OAuth2 client credentials for those registrations, is at risk. The attacker does not need to be authenticated to serve a malicious OpenAPI spec; the victim only needs to register the spec and call one of its generated tools. Consequences: • Credential exfiltration: `client_id` and `client_secret` are sent to the attacker's server, enabling full OAuth2 impersonation under the victim's identity. • SSRF: The attacker can direct POST requests to internal network services (cloud metadata endpoints, internal APIs, localhost services) that are unreachable from outside. • Privilege escalation: Stolen client credentials may grant access to downstream APIs far beyond the scope of the compromised UTCP tool call. Impacted parties include any developer or organization deploying `utcp-http` in a scenario where untrusted or third-party OpenAPI specs are registered alongside OAuth2 credential configuration. Reproduction artifacts `Dockerfile` ```dockerfile FROM python:3.10-slim WORKDIR /app Copy the repository source COPY repo/core/ /app/repo/core/ COPY repo/plugins/communication_protocols/http/ /app/repo/plugins/http/ Install core UTCP package and the HTTP plugin from local source RUN pip install --no-cache-dir /app/repo/core/ && \ pip install --no-cache-dir /app/repo/plugins/http/ Copy the PoC script COPY vuln-001/poc.py /app/poc.py CMD ["python3", "/app/poc.py"] ``` `poc.py` ```python !/usr/bin/env python3 """ VULN-001 Proof of Concept: OAuth2 tokenUrl Trust Boundary Bypass Affected package : utcp-http 1.1.3 Summary ------- An attacker who controls an OpenAPI spec can embed an arbitrary tokenUrl in the OAuth2 security scheme. When a victim registers that spec and later calls any generated tool, the utcp-http library POSTs the victim's client_id and client_secret to the attacker-controlled token endpoint with no URL validation. The validation gap: • openapi_converter.py:369 reads tokenUrl directly from the spec. • http_communication_protocol.py:376 posts credentials to that URL. • ensure_secure_url() is applied to the discovery URL (line 129) and the tool invocation URL (line 281), but NOT to auth_details.token_url (line 376). Reproduction ------------ Three in-process aiohttp servers simulate the three parties: SPEC_SERVER (port 8888) - attacker's server that serves the malicious OpenAPI spec TOKEN_SERVER (port 7777) - attacker's server tha…