T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/market_client.py:63
- Finding
- Bearer API Key May Be Disclosed Through Cross-Origin HTTP Redirects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/market_client.py`, lines 63–75 **Vulnerability Type**: Unrestricted redirect handling with a sensitive authorization header **Risk Level**: Medium ```python headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "User-Agent": "OpenClaw-Market/1.0" } request_data = None if data: request_data = json.dumps(data).encode("utf-8") if method == "POST" and request_data is None: request_data = b"{}" req = urllib.request.Request(url, data=request_data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=60) as response: return json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The client attaches the `AISA_API_KEY` to every request as an `Authorization: Bearer` header and uses `urllib.request.urlopen`, which follows HTTP redirects automatically. The code does not define a redirect policy, validate each redirect destination, or remove sensitive headers when the destination origin changes. Python redirect handling can propagate request headers into redirected requests. If `api.aisa.one` returns a redirect to a different origin, the Bearer credential may consequently be sent to that destination. TLS protects the request in transit but does not prevent credential disclosure when the application voluntarily follows a valid HTTPS redirect. Exploitation requires control over, or compromise of, an API response capable of issuing a redirect. A conventional network attacker without a trusted TLS certificate would not independently satisfy this condition. ### Attack Path 1. A user configures a valid `AISA_API_KEY` and invokes any documented stock or cryptocurrency command. 2. The client sends a request containing `Authorization: Bearer <AISA_API_KEY>` to `https://api.aisa.one`. 3. A compromised or malicious API endpoint responds with an HTTP redirect to an attacker-controlled HTTPS origin. 4. `url ...[truncated 787 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic redirect following for authenticated API requests, or implement a custom `HTTPRedirectHandler`. 2. Permit redirects only when all of the following remain true: - The scheme is `https`. - The normalized hostname is exactly `api.aisa.one`. - The effective port and origin satisfy an explicit allowlist. 3. Remove the `Authorization` header whenever a redirect changes the scheme, hostname, or port. 4. Apply a small redirect limit and reject malformed, protocol-relative, downgraded, or user-information-bearing destinations. 5. Prefer treating unexpected redirects as errors because the configured API endpoint is fixed and ordinarily should not require cross-origin redirection. 6. Add automated tests that verify the credential is not transmitted after same-origin-to-cross-origin, HTTPS-to-HTTP, and multi-hop redirects. 7. If exposure is suspected, revoke and rotate the affected `AISA_API_KEY` and review API usage for unauthorized credit consumption. ]]>