T09 · Insecure Skill Coding Practices
Error
- Location
status.py:25- Finding
Bearer API token may be disclosed through cross-origin redirects in the status client
- Content
View full analysis
dict: """Make authenticated request to Simmer API.""" url = f"{SIMMER_API_BASE}{endpoint}" req = Request(url, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" }) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) ``` ### Technical Analysis The function places the sensitive `SIMMER_API_KEY` in an `Authorization: Bearer` header and passes the request to `urllib.request.urlopen`. Python's default redirect handler follows supported HTTP redirects. The code neither rejects redirects nor verifies that a redirect destination remains on the expected `api.simmer.markets` origin. Request headers can consequently be propagated when constructing a redirected request, including to a different HTTPS origin. If the trusted endpoint or its supporting infrastructure returns a malicious cross-origin redirect, the bearer credential may be sent to the redirect target. Sending the token to the documented Simmer API is necessary for the declared account-status functionality. Allowing that credential to follow redirects to an unrestricted origin exceeds the minimum network privilege required. Exploitation depends on an attacker being able to influence the trusted API's redirect response, such as through API compromise, infrastructure compromise, or a redirect vulnerability. TLS prevents an ordinary passive network observer from simply injecting such a redirect. ### Attack Path 1. The user configures a valid `SIMMER_API_KEY` and runs `status.py`. 2. The script requests a Simmer portfolio or positions endpoint with the bearer token. 3. An attacker-controlled or compromised endpoint returns an HTTP r ...[truncated 917 chars]- Remediation
View remediation