T09 · Insecure Skill Coding Practices
Error
- Location
scripts/okx_client.py:28- Finding
Authenticated REST requests can be redirected to an arbitrary server
- Content
View full analysis
dict: ts = _timestamp() return { "OK-ACCESS-KEY": self.api_key, "OK-ACCESS-SIGN": _sign(ts, method, path, body, self.secret), "OK-ACCESS-TIMESTAMP": ts, "OK-ACCESS-PASSPHRASE": self.passphrase, "OK-ACCESS-SBE": "0", "x-simulated-trading": "1" if self.simulated else "0", "Content-Type": "application/json", } def _request(self, method: str, full_path: str, data: str = None) -> dict: url = BASE_URL + full_path _retryable = ( requests.exceptions.SSLError, requests.exceptions.ConnectionError, requests.exceptions.Timeout, ) for attempt in range(3): try: headers = self._headers(method, full_path, data or "") if method == "GET": r = requests.get(url, headers=headers, timeout=10) else: r = requests.post(url, headers=headers, data=data, timeout=10) ``` ### Technical Analysis The API origin is controlled by the `OKX_API_URL` environment variable without validation of its scheme, hostname, port, or resolved address. All authenticated REST requests use this origin while including the OKX API key, passphrase, timestamp, and HMAC signature in request headers. The base64 operation used for `OK-ACCESS-SIGN` is legitimate HMAC encoding rather than covert obfuscation. However, because the resulting authentication data is sent to an unrestricted destination, a malicious or accidentally modified environment can redirect it away from OKX. The API secret itself is not directly transmitted. Nevertheless, an attacker-controlled endpoint receives: ...[truncated 1573 chars]- Remediation
View remediation