T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_fullpaper.py:27- Finding
API credentials transmitted over plaintext HTTP to a configurable destination
- Content
View full analysis
Dict[str, Any]: req = Request(url, headers={"X-Token": token, "Accept": "application/json"}) with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode("utf-8", errors="replace")) def fetch_by_doc_id(doc_id: str, tokens: Iterable[str]) -> Tuple[Dict[str, Any], str]: url = f"{API_BASE}/api/v1/paper/doc-id/{doc_id}?raw=true" last_err = None for token in tokens: try: payload = http_get_json(url, token) return payload, token ``` ### Technical Analysis The default full-paper API uses unencrypted HTTP while placing the API credential in the `X-Token` request header. Anyone able to observe or modify traffic between the host and the API can recover the credential. The destination is also controlled by `INFOX_MED_API_BASE` without validation of its scheme, hostname, port, or resolved IP address. A process, deployment configuration, or user capable of setting this environment variable can redirect all normalized token candidates to an arbitrary server. The script uses `urllib.request.urlopen`, which may follow HTTP redirects. No control prevents credentials from being exposed through an attacker-controlled destination or network interception. Reading an API credential is necessary for the declared full-paper retrieval function. Sending it over plaintext transport or to an unrestricted configurable host exceeds the minimum privileges required. ### Attack Path 1. An attacker gains the ability to alter deployment environment variables, or intercepts plaintext network traffic. 2. The attacker ...[truncated 734 chars]- Remediation
View remediation