T09 · Insecure Skill Coding Practices
Error
- Location
- content_stock.js:15
- Finding
- API Credential and Query Data Transmitted Over Plaintext HTTP## Vulnerability Details **File Location**: `content_stock.js:15-25` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```javascript const url = "http://[IP_ADDRESS]/api/v1/alpha/content_stock"; const headers = { "Authorization": `Bearer ${EASYALPHA_API_KEY}`, "Content-Type": "application/json" }; const payload = { query: request.query, type: request.type || "deep" }; try { const response = await fetch(url, { ``` The subsequent request configuration at lines 23-27 sends both the authorization header and serialized payload to this plaintext HTTP URL: ```javascript const response = await fetch(url, { method: "POST", headers: headers, body: JSON.stringify(payload) }); ``` ### Technical Analysis The skill sends `EASYALPHA_API_KEY` as a Bearer credential in the HTTP `Authorization` header. It also sends the user-provided stock-analysis query in the request body. Because the destination uses `http://` rather than `https://`, transport encryption and authenticated server identity are absent. Any party able to observe or manipulate traffic between the host and the API endpoint can read the credential and request content. Such a party can also alter requests or streamed responses without reliable detection. The placeholder-style IP address further provides no verifiable service identity in the reviewed implementation. ### Attack Path 1. A user configures a valid `EASYALPHA_API_KEY` and invokes `get_content_stock`. 2. The skill creates a plaintext HTTP request containing `Authorization: Bearer <API_KEY>` and the user-controlled analysis query. 3. An attacker with a network interception position, such as control of an untrusted access point, compromised router, proxy, or relevant network segment, captures or modifies the HTTP traffic. 4. The attacker extracts the Bearer credential and submitted quer ...[truncated 1115 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext endpoint with an `https://` URL served under an explicitly trusted hostname. 2. Require normal TLS certificate and hostname validation. Do not disable certificate verification or accept arbitrary self-signed certificates in production. 3. Reject any configured endpoint whose protocol is not HTTPS, preferably through strict URL validation and an allowlist of approved hosts. 4. Avoid using a raw or placeholder IP address when a stable authenticated service hostname is available. 5. Rotate any API key that may already have been transmitted through this implementation, because its confidentiality cannot be guaranteed. 6. Restrict API keys to the minimum required operations, apply short expiration periods where possible, and enforce server-side rate limits and usage monitoring. 7. Avoid logging authorization headers or full request payloads, and document clearly that user queries are transmitted to an external service. 8. Consider response authentication or application-level integrity protections if the analysis output drives security-sensitive or automated financial actions.