T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hot_topic.py:226- Finding
Gangtise authorization token disclosure through an unrestricted hot-topic API endpoint
- Content
View full analysis
Tuple[Optional[Dict[str, Any]], Optional[str]]: url = f"{openai_root.rstrip('/')}/hot-topic/getList" headers = {"Authorization": GTS_AUTHORIZATION} resp = requests.post(url, headers=headers, json=payload, timeout=300) ``` ```python def run_hot_topic_list( page_from: int = 0, page_size: int = 20, start_date: Optional[str] = None, end_date: Optional[str] = None, category_list: Optional[List[str]] = None, with_related_securities: bool = False, with_close_reading: bool = False, output: Optional[str] = None, openai_root: Optional[str] = None, ) -> str: if not openai_root: openai_root = os.getenv("GANGTISE_OPENAI_ROOT", "https://open.gangtise.com/application/open-ai") ``` ### Technical Analysis The request destination is derived from the `openai_root` function argument or the `GANGTISE_OPENAI_ROOT` environment variable. Neither source is validated before the global Gangtise authorization token is placed in the HTTP `Authorization` header. Consequently, the request is not restricted to the declared Gangtise API origin. A caller that can invoke `run_hot_topic_list()` directly can supply any URL, while a process that can influence the execution environment can set `GANGTISE_OPENAI_ROOT`. The implementation also does not require HTTPS, so it can send the token over plaintext HTTP. Sending authenticated requests to Gangtise is necessary for the Skill's declared functionality. Allowing the credential-bearing destination to be changed to an arbitrary origin exceeds that minimum requirement. ### Attack Path 1. The attacker influences the function argument or executi ...[truncated 1082 chars]- Remediation
View remediation