T09 · Insecure Skill Coding Practices
Error
- Location
scripts/weex_spot_api.py:160- Finding
Spot API credentials can be transmitted to an arbitrary host through an unrestricted base URL
- Content
View full analysis
Dict[str, Any]: req = request.Request( url=prepared["url"], method=prepared["method"], data=prepared["data"], headers=prepared["headers"], ) try: with request.urlopen(req, timeout=self.timeout) as resp: ``` The destination is supplied without validation: ```python parser.add_argument("--base-url", default=os.getenv("WEEX_SPOT_API_BASE", DEFAULT_BASE_URL)) ``` ### Technical Analysis The Spot client accepts its base URL from either the `--base-url` command-line option or the `WEEX_SPOT_API_BASE` environment variable. It does not validate the URL scheme, hostname, port, user-information component, or path. For authenticated endpoints, the client then attaches the following sensitive headers to a request targeting that unrestricted URL: - `ACCESS-KEY` - `ACCESS-PASSPHRASE` - `ACCESS-TIMESTAMP` - `ACCESS-SIGN` The HMAC-SHA256 signature is Base64-encoded as required by the WEEX authentication protocol. That encoding is legitimate and is not, by itself, a covert exfiltration mechanism. The security f ...[truncated 2551 chars]- Remediation
View remediation