T09 · Insecure Skill Coding Practices
Error
- Location
scripts/query_balance.py:31- Finding
Arbitrary API URL Allows Exfiltration of Payful Session Credentials
- Content
View full analysis
dict: """Query Payful account balance.""" base_url = api_url or "https://global.payful.com" endpoint = f"{base_url}/api/user/account/queryUserAccBalByHomePage" user_id = get_env_var("PAYFUL_USER_ID") token = get_env_var("PAYFUL_TOKEN") cookie = f"AGL_USER_ID={user_id}; BF-INTERNATIONAL-MEMBER-TOKEN={token}" headers = { 'Accept': 'application/json, text/plain, */*', 'Accept-Language': 'zh-CN', 'Connection': 'keep-alive', 'Cookie': cookie, ``` ```python def main(): import argparse parser = argparse.ArgumentParser(description='Query Payful account balance') parser.add_argument('--api-url', help='Custom API base URL') parser.add_argument('--json', action='store_true', help='Output JSON') parser.add_argument('--raw', action='store_true', help='Output raw response') args = parser.parse_args() result = query_balance(args.api_url) ``` ### Technical Analysis The `--api-url` command-line option accepts an unrestricted URL and passes it directly to `query_balance`. The supplied value becomes the request's base URL, while the script unconditionally attaches the sensitive `PAYFUL_USER_ID` and `PAYFUL_TOKEN` values as cookies. No validation restricts the destination to an approved Payful hostname, enforces HTTPS, rejects unexpected ports, or otherwise establishes that credentials are being sent to a trusted origin. Consequently, a caller can select an attacker-controlled HTTP or HTTPS server as the destination. Use of plain HTTP would also expose the credentials to network interception. The documentation identifies these values as b ...[truncated 1939 chars]- Remediation
View remediation