T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/weex_spot_api.py:160
- Finding
- Spot API credentials can be transmitted to an arbitrary host through an unrestricted base URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/weex_spot_api.py:160-194, 365` **Vulnerability Type**: Arbitrary credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```python if endpoint.requires_auth: self._require_auth() ts = str(int(time.time() * 1000)) sign = self._sign(ts, method, endpoint.path, query_string, body_str) headers.update( { "ACCESS-KEY": self.api_key, "ACCESS-PASSPHRASE": self.api_passphrase, "ACCESS-TIMESTAMP": ts, "ACCESS-SIGN": sign, } ) url = f"{self.base_url}{endpoint.path}" if query_string: url = f"{url}?{query_string}" data = body_str.encode("utf-8") if body_str and method != "GET" else None return { "method": method, "url": url, "headers": headers, "data": data, "query": q, "body": b, } def send(self, prepared: Dict[str, Any]) -> Dict[str, Any]: req = request.Request( url=prepared["url"], method=prepared["method"], data=prepared["data"], headers=prepared["headers"], ) try: with request.urlopen(req, timeout=self.timeout) as resp: ``` The destination is supplied without validation: ```python parser.add_argument("--base-url", default=os.getenv("WEEX_SPOT_API_BASE", DEFAULT_BASE_URL)) ``` ### Technical Analysis The Spot client accepts its base URL from either the `--base-url` command-line option or the `WEEX_SPOT_API_BASE` environment variable. It does not validate the URL scheme, hostname, port, user-information component, or path. For authenticated endpoints, the client then attaches the following sensitive headers to a request targeting that unrestricted URL: - `ACCESS-KEY` - `ACCESS-PASSPHRASE` - `ACCESS-TIMESTAMP` - `ACCESS-SIGN` The HMAC-SHA256 signature is Base64-encoded as required by the WEEX authentication protocol. That encoding is legitimate and is not, by itself, a covert exfiltration mechanism. The security f ...[truncated 2551 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the configured base URL before creating any authenticated request. 2. Require the `https` scheme. 3. Allowlist the exact official Spot API hostname: - `api-spot.weex.com` 4. Reject URLs containing: - User-information components. - Fragments. - Unexpected ports. - Unexpected path prefixes. - Non-HTTPS schemes. 5. Perform validation immediately before sending, not only while parsing command-line arguments. 6. Prevent authentication headers from being forwarded to a different origin during redirects. Prefer disabling redirects for authenticated API requests or validating every redirect target. 7. If custom endpoints are required for local testing: - Require a separate, explicitly unsafe testing option. - Display a prominent warning. - Refuse to load production credential environment variables in custom-host mode. - Require separately named test credentials. 8. Add automated tests confirming that authenticated requests to unknown hosts, plain HTTP destinations, and unexpected ports are rejected. 9. Document that production credentials must only be sent to the official WEEX API origin. ]]>