T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/optionflow.py:41- Finding
OptionWhales API Key May Be Forwarded During Cross-Origin Redirects
- Content
View full analysis
dict: """Make an authenticated GET request to the Pro API.""" url = f"{API_BASE}{path}" req = urllib.request.Request(url, headers={"X-API-Key": api_key}) try: with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) ``` ### Technical Analysis The client attaches `OPTIONWHALES_API_KEY` to an HTTP request and passes it to `urllib.request.urlopen()`. Python's default URL opener automatically processes HTTP redirects, but this client does not verify that the final destination retains the original HTTPS scheme and hostname. Because the API key is added as a regular request header, redirect handling can copy it to a redirected request. If the trusted API endpoint is compromised or returns a malicious cross-origin redirect, the credential may be sent to an attacker-controlled destination. The initial destination is a fixed, documented HTTPS endpoint, and user-controlled path components cannot directly change its origin. Therefore, exploitation requires control of, or the ability to influence, a response from the trusted endpoint or its infrastructure. A DNS change alone would not normally be sufficient without a valid TLS certificate. ### Attack Path 1. A user configures a valid `OPTIONWHALES_API_KEY` and invokes `optionflow.py`. 2. The client sends an authenticated request to `https://api.optionwhales.io/v1`. 3. A compromised or malicious upstream endpoint responds with an HTTP redirect to an attacker-controlled HTTPS URL. 4. The default redirect handler follows the redirect without an application-level same-origin check. 5. The `X-API-Key` header is forwarded to the attacker-controlled service. 6. The at ...[truncated 660 chars]- Remediation
View remediation