T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:20- Finding
Predictable Hard-Coded MD5 Request Signatures Provide No Effective Request Integrity
- Content
View full analysis
`, `lang=zh-cn` - **인증 헤더**: `authcode: "HH " + access_token` (로그인 계열 제외) - **서명**: `sign = MD5( + ).toUpperCase()` — 엔드포인트별 salt는 각 문서 참조 ``` `gds_m_addgoods.md:9-12`: ```markdown 【호출 흐름】 1. authcode: \"HH \" + 판매자 access_token (반드시 \"HH \" 접두사 필요) 2. sign: MD5('as0jusem$asldk').toUpperCase() 3. POST JSON body ``` `gds_m_goodsclasslist.md:5-9`: ```markdown 【호출 흐름】 1. 공통 헤더 설정: v=7.0.1, p=1, t=현재 Unix 타임스탬프, lang=zh-cn 2. authcode 설정: \"HH \" + 판매자 access_token (반드시 \"HH \" 접두사 필요, 그렇지 않으면 401 반환) 3. sign 계산: MD5('jskdn$dh3hjsb').toUpperCase() (고정 솔트값, 파라미터 결합 안 함) 4. GET 요청, query 파라미터 없음 ``` The same pattern appears throughout the endpoint documentation, including seller operations that create, delete, or modify product prices and inventory. ### Technical Analysis The documented signing constants are embedded directly in the Skill and are therefore available to every user who can obtain the package. Several endpoint instructions calculate MD5 over only a fixed string. Such a digest is constant across all requests to that endpoint and is not cryptographically bound to the HTTP method, path, request body, access token, timestamp, or nonce. This construction cannot provide request authenticity or integrity. Anyone who knows the documented constant can calculate the expected digest. A captured signature can also be replayed without modification. MD5 is additionally unsuitable for modern cryptographic authentication, but the more fundamental problem is that the construction is an unkeyed, request-independent hash. The `authcode` ...[truncated 1547 chars]- Remediation
View remediation