T09 · Insecure Skill Coding Practices
Error
- Location
- status.py:25
- Finding
- Bearer API token may be disclosed through cross-origin redirects in the status client<![CDATA[ ## Vulnerability Details **File Location**: `status.py`, lines 25–34 **Vulnerability Type**: Authenticated cross-origin redirect / credential disclosure **Risk Level**: High ### Vulnerable Code ```python def api_request(api_key: str, endpoint: str) -> dict: """Make authenticated request to Simmer API.""" url = f"{SIMMER_API_BASE}{endpoint}" req = Request(url, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" }) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) ``` ### Technical Analysis The function places the sensitive `SIMMER_API_KEY` in an `Authorization: Bearer` header and passes the request to `urllib.request.urlopen`. Python's default redirect handler follows supported HTTP redirects. The code neither rejects redirects nor verifies that a redirect destination remains on the expected `api.simmer.markets` origin. Request headers can consequently be propagated when constructing a redirected request, including to a different HTTPS origin. If the trusted endpoint or its supporting infrastructure returns a malicious cross-origin redirect, the bearer credential may be sent to the redirect target. Sending the token to the documented Simmer API is necessary for the declared account-status functionality. Allowing that credential to follow redirects to an unrestricted origin exceeds the minimum network privilege required. Exploitation depends on an attacker being able to influence the trusted API's redirect response, such as through API compromise, infrastructure compromise, or a redirect vulnerability. TLS prevents an ordinary passive network observer from simply injecting such a redirect. ### Attack Path 1. The user configures a valid `SIMMER_API_KEY` and runs `status.py`. 2. The script requests a Simmer portfolio or positions endpoint with the bearer token. 3. An attacker-controlled or compromised endpoint returns an HTTP r ...[truncated 917 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic redirect handling for authenticated requests and treat redirects as errors unless explicitly required. 2. If redirects are operationally necessary, validate every redirect before following it: - Require the `https` scheme. - Require the normalized hostname to be exactly `api.simmer.markets`. - Reject user-info, unexpected ports, and hostname suffix tricks. 3. Remove the `Authorization` header whenever the scheme, hostname, or effective port changes. 4. Apply the same hardened request helper to every authenticated Simmer API operation. 5. Use narrowly scoped and revocable API keys. A status-only client should use a read-only key when the service supports one. 6. Avoid returning or logging credentials in exception messages, diagnostics, or response bodies. 7. Add automated tests covering same-origin redirects, cross-origin redirects, protocol downgrades, and malformed redirect targets. ]]>