T09 · Insecure Skill Coding Practices
- Location
scripts/fetch-all-data.mjs:82- Finding
Market Data Retrieved over Unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch-all-data.mjs, lines 82–94 and 1256–1259
Vulnerability Type: Use of an unauthenticated plaintext market-data source
Risk Level: MediumVulnerable Code
js // 1b. OmetalCN 長江現貨（GBK 頁面，備用源） // URL: http://app.ometal.cn/data/mlist.asp // 品種：Cu / Al / Pb / Zn / Ni / Sn + 升貼水 // 優勢：有 A00鋁（CCMN 常缺）、解析穩定、響應快 // ──────────────────────────────────────────── async function fetchOmetal() { try { const res = await fetch('http://app.ometal.cn/data/mlist.asp', { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/html', 'Referer': 'http://app.ometal.cn/', },The untrusted response is later accepted as a fallback source:
js aluminum: { usd: alumSpot.ok ? alumSpot.price : null, usdChangePct: alumSpot.ok ? alumSpot.changePct : null, usdUnit: 'USD/t', // v11: 優先 CCMN A00鋁 → 備用 OmetalCN A00鋁（SMM 無鋁 h5 頁面） cny: ccmn?.aluminum?.price ?? ometal?.aluminum?.price ?? null, cnyChange: ccmn?.aluminum?.updown ?? ometal?.aluminum?.change ?? null, cnySource: ccmn?.aluminum?.price != null ? 'CCMN' : (ometal?.aluminum?.price != null ? 'OmetalCN' : null), },Technical Analysis
The production data collector retrieves a price page through plain HTTP. HTTP provides neither transport confidentiality nor server authenticity. Any party able to intercept traffic between the host and
app.ometal.cn—including a compromised gateway, hostile Wi-Fi access point, ISP-level intermediary, or poisoned network route—can modify the HTML response.The application decodes and parses the response without cryptographic verification. If the preferred CCMN aluminum value is unavailable, the parsed Ometal value is accepted directly as the CNY aluminum price and exported in the collector's JSON output. There is no independent TLS-protected cross-check, deviation threshold, or plausibility rejection before accepting th ...[truncated 1516 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the HTTP endpoint with an HTTPS endpoint that presents a valid, trusted certificate.
- If the source does not support HTTPS, remove it from production fallback logic rather than accepting unauthenticated financial data.
- Cross-check fallback values against an independent TLS-protected source before exporting them.
- Enforce plausibility controls, including:
- Maximum day-over-day change thresholds.
- Expected numeric ranges.
- Maximum deviation from other trusted sources.
- Data freshness and date validation.
- Mark values as unavailable when validation fails instead of silently selecting the fallback.
- Remove aluminum collection entirely if it remains outside the Skill's declared scope, thereby reducing unnecessary network access and attack surface.