T09 · Insecure Skill Coding Practices
Error
- Location
endpoints.md:3- Finding
Unauthenticated Credential-Backed Trading Interface
- Content
View full analysis
Vulnerability Details
File Location:
endpoints.md:3-16; related instructions inSKILL.md:11andSKILL.md:217-219
Vulnerability Type: Missing authentication and overly broad command access
Risk Level: HighVulnerable Code
markdown Base URL: `http://localhost:9009` No token or API key is needed by callers. All credentials live in `.env` on the server. --- ## REST Endpoints | Method | Path | Description | |---|---|---| | `POST` | `/api/set-account` | Switch active account (optional — auto-set from `.env` on startup) | | `POST` | `/api/trendbars` | OHLC candle data | | `POST` | `/api/live-quote` | Recent tick/quote data | | `POST` | `/api/market-order` | Place market, limit, or stop order | | `GET` | `/get-data?command=...` | Generic passthrough for any cTrader command |The generic endpoint exposes sensitive commands including:
markdown | `ProtoOAGetAccountListByAccessTokenReq` | — | List all accounts on this token | | `ProtoOATraderReq` | — | Account details (balance, equity, leverage) | | `ProtoOAReconcileReq` | — | Open positions and pending orders | | `NewMarketOrder` | `symbolId tradeSide volume comment [sl] [tp]` | Place market order | | `NewLimitOrder` | `symbolId tradeSide volume price` | Place limit order | | `NewStopOrder` | `symbolId tradeSide volume price` | Place stop order | | `ClosePosition` | `positionId volumeInUnits` | Close an open position | | `CancelOrder` | `orderId` | Cancel a pending order |Technical Analysis
The proxy performs credential-backed financial operations without requiring a caller token or API key. It relies on the service being reachable through
localhost, but local network placement is not an authentication or authorization control. Any local process, compromised agent, malicious browser-assisted request path, or container sharing the relevant network namespace may be able to invoke the interface.The generic ...[truncated 2522 chars]
- Remediation
View remediation
Remediation Suggestions
- Require cryptographically strong authentication for every request, even when the service binds only to loopback.
- Prefer a protected Unix-domain socket or equivalent OS-controlled IPC mechanism over an unauthenticated TCP listener.
- Implement per-operation authorization and separate read-only market-data access from account-data and trading permissions.
- Remove the generic command passthrough. Replace it with explicit, allowlisted endpoints that validate all command names and arguments.
- Disable account enumeration and runtime account switching unless they are essential. Restrict account IDs to an administrator-configured allowlist.
- Require explicit user confirmation immediately before every financial mutation, including order placement, position closure, cancellation, and account switching.
- Apply server-side limits for volume, position size, instrument selection, order frequency, and maximum financial exposure.
- Validate all request fields against strict schemas and reject unknown properties, unsupported commands, malformed identifiers, and out-of-range values.
- Add rate limiting, request auditing, immutable transaction logs, and alerts for sensitive operations.
- Run the proxy under a dedicated low-privilege OS identity and prevent untrusted containers or processes from reaching its listening interface.
- Avoid plaintext HTTP where traffic can cross a namespace or host boundary; use authenticated encryption when IPC cannot remain strictly local.