T09 · Insecure Skill Coding Practices
- Location
references/费用报销PC端操作手册.md:1- Finding
Financial System Login Link Uses Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
references/费用报销PC端操作手册.md, line 1
Vulnerability Type: Plaintext HTTP link for a financial system login workflow
Risk Level: MediumVulnerable Code
markdown 登录网址[www.jdy.com](http://www.jdy.com)The text identifies
www.jdy.comas the login address, while the actual hyperlink uses unencrypted HTTP.Technical Analysis
The operating manual directs users to begin a financial-system login workflow through
http://www.jdy.com. An initial HTTP request is neither encrypted nor authenticated. Even if the legitimate server normally redirects users to HTTPS, that redirect is received only after the vulnerable plaintext request has traversed the network.An attacker capable of intercepting or modifying network traffic—such as an operator of a malicious Wi-Fi access point, a compromised gateway, or another on-path adversary—could replace the HTTP response before any legitimate HTTPS redirect occurs. The attacker could redirect the user to a visually similar phishing site or inject misleading login instructions.
This is relevant because the referenced system handles reimbursement records, invoices, and financial account information. The audit did not verify that the destination itself is malicious, and the project does not programmatically submit credentials or perform network requests. The issue is specifically the insecure protocol used by the documented login link.
Attack Path
- An employee opens the reimbursement manual and follows the documented link.
- The browser sends an unauthenticated plaintext HTTP request for
www.jdy.com. - An on-path attacker intercepts the request before the legitimate server responds.
- The attacker returns a redirect to a lookalike domain or serves a spoofed login page.
- The employee enters credentials or other sensitive information into the fraudulent page.
- The attacker captures that information and may attempt to access the legitimate reimbursemen ...[truncated 933 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the plaintext URL with the service's verified canonical HTTPS login URL:
markdown Login URL: [https://www.jdy.com](https://www.jdy.com) -
Confirm the canonical login address through the vendor's trusted documentation before publishing the replacement.
-
Add guidance requiring users to verify the exact HTTPS hostname and valid certificate before entering credentials.
-
Warn users not to proceed if the browser reports a certificate error, uses an unexpected domain, or falls back to HTTP.
-
Where available, direct users through a trusted corporate portal or managed bookmark rather than a manually entered public URL.
-
Enable multifactor authentication and phishing-resistant authentication controls for reimbursement accounts where supported.
-
Search future documentation releases for
http://login or payment links and reject them during review unless there is a documented, non-sensitive justification.
-