T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/whoop_chart.py:41- Finding
Unpinned remote JavaScript executes with access to embedded health data
- Content
View full analysis
Whoop - {title} ``` The generated page embeds the user's health data and then automatically opens in a browser: ```python html = HTML_TEMPLATE.format( title=title, subtitle=subtitle, stats_html=stats_html, charts_html=charts_html, chart_data=json.dumps(chart_data), chart_scripts=chart_scripts, timestamp=timestamp, ) with open(filepath, "w", encoding="utf-8") as f: f.write(html) print(f"Chart saved to: {filepath}") # Open in browser try: webbrowser.open(f"file://{filepath}") except Exception: pass ``` The corresponding template exposes those metrics to all scripts running in the page: ```html ``` ### Technical Analysis The URL `https://cdn.jsdelivr.net/npm/apexcharts` does not select an immutable ApexCharts version and does not provide a Subresource Integrity hash. Consequently, the JavaScript executed by the generated report can change after the Skill has been audited. The remote script executes in the same page as `chartData`, which can contain dates, sleep duration and stages, recovery scores, HRV, resting heart rate, strain, and other private health metrics. A malicious or compromised CDN response can read these values directly and transmit them to an attacker-controlled server using ordinary browser network APIs. Loading a charting library is related to the declared visualization functionality, but retrieving mutable executable code ...[truncated 1564 chars]- Remediation
View remediation