T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_kline.py:16- Finding
Unauthenticated HTTP Transport Allows Market Data Manipulation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_kline.py, lines 16–20
Vulnerability Type: Unauthenticated plaintext transport
Risk Level: Mediumpython url = f"http://hq.sinajs.cn/list={code}" try: req = urllib.request.Request(url, headers={"Referer": "https://finance.sina.com.cn"}) with urllib.request.urlopen(req, timeout=5) as resp: data = resp.read().decode("gbk")Technical Analysis
The script retrieves financial quote data through plaintext HTTP. Although the
Refererheader contains an HTTPS URL, it does not protect the actual request or authenticate the response. An attacker with a network position—such as a malicious access point, compromised proxy, ISP-level interceptor, or local network attacker—can read and modify the response in transit.The script extracts the first quoted value from the response and converts its comma-separated fields directly into opening, closing, high, low, and volume values. It performs no cryptographic integrity verification and no meaningful validation of the response's origin or financial consistency. Consequently, a modified but syntactically valid response will be accepted as genuine market data.
Attack Path
- A user invokes the Skill to retrieve a stock quote.
- The script sends a request to
http://hq.sinajs.cn/list={code}over an unencrypted connection. - A network-positioned attacker intercepts the request or response.
- The attacker replaces the response with a syntactically valid payload containing forged price and volume fields.
- The regular expression and comma-separated parser accept the forged response.
- The script displays the manipulated quote and calculates moving-average estimates from the attacker-controlled closing price.
- A user or downstream agent may rely on the forged output for financial analysis.
Impact Assessment
Exploitation does not grant the attacker local code execution, filesys ...[truncated 310 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with an official HTTPS endpoint that provides valid certificate-based server authentication.
- Explicitly reject redirects that downgrade the connection from HTTPS to HTTP.
- Validate the response format before processing it, including the expected symbol, exact field count, numeric types, nonnegative volume, and coherent price ranges.
- Treat malformed, unexpected, or unauthenticated responses as failures rather than producing derived financial values.
- Catch specific network, decoding, and parsing exceptions instead of using a bare
except, and return a clear error without exposing sensitive diagnostic details. - If the provider does not support authenticated transport, migrate to a provider that does rather than silently accepting plaintext market data.