T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/analyser.py:123
- Finding
- Unauthenticated HTTP Transport Allows Market-Data Response Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyser.py`, lines 123-137 **Vulnerability Type**: Cleartext HTTP request without transport authenticity **Risk Level**: Medium ### Vulnerable Code ```python url = f"http://datacenter-web.eastmoney.com/api/data/v1/get" params = { "sortColumns": "NET_BUY_AMT", "sortTypes": "-1", "pageSize": "50", "pageNumber": "1", "reportName": "RPT_DMSK_TS", "columns": "ALL", "filter": f"(TRADE_DATE='{date}')" } try: resp = self.session.get(url, params=params, timeout=10) data = resp.json() return data.get("result", {}).get("data", []) ``` ### Technical Analysis The `fetch_dragon_tiger()` functionality retrieves financial data through unauthenticated cleartext HTTP. HTTP does not provide server authentication, confidentiality, or response integrity. An attacker capable of observing or modifying the network connection can intercept the request and replace the response with attacker-controlled JSON. The implementation accepts the response without checking the HTTP status, content type, response schema, or authenticity. This method is not invoked by the current main monitoring loop, which limits immediate exposure. However, it is a public part of the analysis engine and becomes exploitable whenever a caller uses `fetch_dragon_tiger()`. ### Attack Path 1. A user or another component invokes `StockAnalyser.fetch_dragon_tiger()`. 2. The application sends a cleartext HTTP request to the Eastmoney endpoint. 3. An attacker controlling a network gateway, proxy, wireless access point, or other on-path infrastructure intercepts the request. 4. The attacker returns fabricated JSON matching the expected high-level structure. 5. `resp.json()` parses the malicious response. 6. The application accepts and returns the forged financial records without detecting the manipulation. ### Impact Assessment An attacker can manipulate the Dragon Tiger market data returned by this method, inc ...[truncated 343 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the HTTP endpoint with an HTTPS endpoint supplied by the provider: ```python url = "https://datacenter-web.eastmoney.com/api/data/v1/get" ``` 2. Prevent HTTPS-to-HTTP redirect downgrades, or explicitly verify that the final response URL uses HTTPS. 3. Check the response status before parsing: ```python resp.raise_for_status() ``` 4. Validate that the response content type is JSON. 5. Validate the complete response schema and expected field types before returning records. 6. Treat malformed or unexpected data as an error rather than silently accepting partial structures. 7. If the provider does not support HTTPS, remove or disable the functionality instead of transmitting requests over cleartext HTTP. ]]>