T09 · Insecure Skill Coding Practices
Error
- Location
- scripts_files/risk_monitor.py:23
- Finding
- Unauthenticated HTTP Market Data Can Be Manipulated to Produce False Risk Alerts<![CDATA[ ## Vulnerability Details **File Location**: `scripts_files/risk_monitor.py`, lines 23-31 **Vulnerability Type**: Unencrypted and unauthenticated external market-data transport **Risk Level**: High ### Vulnerable Code ```python url = f'http://qt.gtimg.cn/q={code}' try: r = requests.get(url, timeout=5) data = r.text.split('~') if len(data) > 45: return { 'price': float(data[3]), 'change_pct': float(data[32]), 'name': data[1] } ``` ### Technical Analysis The risk monitor obtains security prices from a plaintext HTTP endpoint. HTTP provides neither transport encryption nor server authentication, so an attacker able to observe or modify network traffic can intercept the requested stock code and alter the returned price fields. The program directly trusts response fields `data[3]` and `data[32]`. These values control portfolio profit-and-loss calculations and the generation of stop-loss, take-profit, intraday-crash, and intraday-surge alerts. The implementation does not authenticate the response, verify the HTTP status, restrict redirects to HTTPS, or validate the returned quote against an independent source. Although the code checks the number of response fields, that structural check does not establish the integrity or authenticity of the data. ### Attack Path 1. A user invokes `risk_monitor.py` while connected through a network controlled or observable by an attacker, such as a hostile Wi-Fi access point, compromised router, or malicious proxy. 2. The script sends the portfolio stock code to `http://qt.gtimg.cn`. 3. The attacker intercepts the plaintext response. 4. The attacker substitutes forged values for the current price or daily percentage change. 5. The script parses the forged fields and treats them as authentic market data. 6. The risk calculations produce false results, potentially suppressing a genuine stop-loss warning or creating a fraudulent alert. 7. The user may make ...[truncated 735 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the plaintext endpoint with a supported HTTPS market-data API that provides valid certificate-based server authentication. 2. Reject redirects from HTTPS to HTTP and allow only explicitly approved hosts. 3. Validate transport and response status before processing data: ```python response = requests.get(approved_https_url, timeout=5, allow_redirects=False) response.raise_for_status() ``` 4. Validate the response schema, stock identifier, expected encoding, numeric types, and plausible price ranges before using returned values. 5. Treat missing, malformed, or unauthenticated data as a monitoring failure rather than reporting that portfolio risk is normal. 6. Consider checking high-impact alerts against a second independent authenticated data provider. 7. Avoid including portfolio identifiers in logs or error reports beyond what is operationally necessary. ]]>