T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/okx_client.py:28
- Finding
- Authenticated REST requests can be redirected to an arbitrary server<![CDATA[ ## Vulnerability Details **File Location**: `scripts/okx_client.py`, lines 28 and 76–101 **Vulnerability Type**: Unvalidated authenticated API endpoint override **Risk Level**: High ### Vulnerable Code ```python BASE_URL = os.getenv("OKX_API_URL", "https://www.okx.com") ``` ```python def _headers(self, method: str, path: str, body: str = "") -> dict: ts = _timestamp() return { "OK-ACCESS-KEY": self.api_key, "OK-ACCESS-SIGN": _sign(ts, method, path, body, self.secret), "OK-ACCESS-TIMESTAMP": ts, "OK-ACCESS-PASSPHRASE": self.passphrase, "OK-ACCESS-SBE": "0", "x-simulated-trading": "1" if self.simulated else "0", "Content-Type": "application/json", } def _request(self, method: str, full_path: str, data: str = None) -> dict: url = BASE_URL + full_path _retryable = ( requests.exceptions.SSLError, requests.exceptions.ConnectionError, requests.exceptions.Timeout, ) for attempt in range(3): try: headers = self._headers(method, full_path, data or "") if method == "GET": r = requests.get(url, headers=headers, timeout=10) else: r = requests.post(url, headers=headers, data=data, timeout=10) ``` ### Technical Analysis The API origin is controlled by the `OKX_API_URL` environment variable without validation of its scheme, hostname, port, or resolved address. All authenticated REST requests use this origin while including the OKX API key, passphrase, timestamp, and HMAC signature in request headers. The base64 operation used for `OK-ACCESS-SIGN` is legitimate HMAC encoding rather than covert obfuscation. However, because the resulting authentication data is sent to an unrestricted destination, a malicious or accidentally modified environment can redirect it away from OKX. The API secret itself is not directly transmitted. Nevertheless, an attacker-controlled endpoint receives: ...[truncated 1573 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `OKX_API_URL` configurability unless it is operationally necessary. 2. Maintain an exact allowlist of approved origins, for example: - `https://www.okx.com` 3. Parse the URL with `urllib.parse.urlparse` and require: - HTTPS - An exact allowlisted hostname - An approved port - No embedded username or password 4. Refuse to attach authentication headers when the destination is not allowlisted. 5. Consider separate fixed clients for public and authenticated endpoints. 6. Prevent redirects on authenticated requests or verify every redirect destination before forwarding authentication headers. 7. Document any supported regional OKX origins explicitly rather than accepting arbitrary values. 8. Add tests proving that HTTP, unapproved domains, deceptive subdomains, and user-info URL forms are rejected. ]]>