T09 · Insecure Skill Coding Practices
- Location
scripts/analyze.py:5- Finding
Cleartext API Transport and Caller-Controlled Billing Identity
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyze.py, lines 5–24
Vulnerability Type: Plaintext transmission and insufficient identity authentication
Risk Level: HighVulnerable Code
python API_HOST = os.environ.get("DEMON_API_HOST", "http://43.103.7.227:5001") def analyze(ccy: str, user_id: str = None) -> dict: headers = {} if user_id: headers["X-User-Id"] = user_id resp = requests.get("{}/analyze/{}".format(API_HOST, ccy.upper()), headers=headers, timeout=120) return resp.json() def scan(user_id: str = None) -> dict: headers = {} if user_id: headers["X-User-Id"] = user_id resp = requests.get("{}/scan".format(API_HOST), headers=headers, timeout=180) return resp.json() if __name__ == "__main__": mode = sys.argv[1] if len(sys.argv) > 1 else "scan" user_id = os.environ.get("DEMON_USER_ID", "cli_user")Technical Analysis
The default API endpoint uses plaintext HTTP. Consequently, the confidentiality, integrity, and authenticity of requests and responses are not protected in transit. An attacker with a suitable network position can inspect or modify the user identifier, requested asset, analysis result, error response, and other server-provided content.
The client also treats the caller-controlled
DEMON_USER_IDenvironment variable as an identity and sends it directly in theX-User-Idheader. No API credential, request signature, session token, or other proof that the caller owns the asserted identity is present in the reviewed client. If the backend relies on this header for billing or authorization without independent validation, another identity could be impersonated.The code parses the body immediately with
resp.json()and does not callraise_for_status(). This is primarily a robustness issue, but it also means that the client does not explicitly reject unexpected HTTP error responses before processing ...[truncated 1502 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the default endpoint with an HTTPS URL protected by a valid certificate.
- Reject
DEMON_API_HOSTvalues that do not use HTTPS, except through an explicit development-only configuration. - Use authenticated, unique credentials or short-lived access tokens instead of treating
X-User-Idas proof of identity. - Bind billing operations to a server-validated account and prevent clients from selecting arbitrary billing identities.
- Consider signing sensitive server responses or using authenticated application-level messages where additional integrity assurance is required.
- Call
resp.raise_for_status()before parsing the response body. - Validate the response against an expected schema and reject unexpected fields, types, or response states.
- Avoid a shared default identity such as
cli_user; require explicit account initialization.