other
Error
- Location
scripts/publish_xhs.py:205- Finding
Authenticated Session Cookie Disclosure to an Arbitrary API Endpoint
- Content
View full analysis
str: """Get the API service address.""" return os.getenv('XHS_API_URL', 'http://localhost:5005') ``` ```python class ApiPublisher: """API publishing mode.""" def __init__(self, cookie: str, api_url: str = None): self.cookie = cookie self.api_url = api_url or get_api_url() self.session_id = 'md2redbook_session' def init_client(self): print(f"Connecting to API service: {self.api_url}") try: resp = requests.get(f"{self.api_url}/health", timeout=5) if resp.status_code != 200: raise Exception("API service unavailable") except requests.exceptions.RequestException as e: print(f"Unable to connect to API service: {e}") sys.exit(1) try: resp = requests.post( f"{self.api_url}/init", json={ "session_id": self.session_id, "cookie": self.cookie }, timeout=30 ) result = resp.json() ``` ```python parser.add_argument( '--api-url', default=None, help='API service address' ) if args.api_mode: publisher = ApiPublisher(cookie, args.api_url) else: publisher = LocalPublisher(cookie) ``` ### Technical Analysis The publishing script reads the complete `XHS_COOKIE` value, which includes authentication fields such as `web_session`, and sends it in plaintext JSON to the endpoint selected through `--api-url` or `XHS_API_URL`. The destination is not restricted to localhost or an approved hostname. The code performs no URL scheme validation, host ...[truncated 1751 chars]- Remediation
View remediation