T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/seats_client.py:42
- Finding
- API Credential May Be Disclosed Through Cross-Origin HTTP Redirects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/seats_client.py`, lines 42–59 **Vulnerability Type**: Authorization-header disclosure through automatically followed redirects **Risk Level**: Medium ### Vulnerable Code ```python req = urllib.request.Request( url, method="GET", headers={ "Accept": "application/json", "Partner-Authorization": self.api_key, "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36", "Accept-Language": "en-US,en;q=0.9", "Accept-Encoding": "gzip, deflate", "Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Site": "same-site", "Referer": "https://seats.aero/", "Origin": "https://seats.aero", }, ) try: with urllib.request.urlopen(req, timeout=self.timeout_seconds) as resp: ``` ### Technical Analysis The client correctly uses HTTPS and must send the `Partner-Authorization` API credential to the declared Seats.aero Partner API. This initial credential transmission is necessary for the Skill's advertised functionality. However, `urllib.request.urlopen()` follows HTTP redirects automatically. The code neither validates the redirect destination nor installs a redirect handler that removes `Partner-Authorization` when the request origin changes. Custom request headers can consequently be propagated to a redirected request. A redirect from the trusted Seats.aero endpoint to a different origin could expose the API key to that origin. Exploitation depends on the trusted endpoint, or an upstream component controlling its responses, returning a cross-origin redirect. No attacker-controlled base URL or confirmed open redirect was found in the reviewed project, so the issue does not provide a direct standalone exploitation mechanism. The network behavior flagged in `scripts/check_awards.py` is limited to reading `SEATS_AERO_API_KEY` and passing ...[truncated 1382 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic redirects for authenticated requests, or implement a custom `HTTPRedirectHandler`. 2. Permit redirects only when all of the following remain true: - The destination scheme is `https`. - The normalized hostname is exactly `seats.aero`, or another explicitly approved Seats.aero API hostname. - The destination port is the expected HTTPS port. 3. Remove `Partner-Authorization` from every redirected request when the scheme, host, or port changes. 4. Prefer rejecting cross-origin redirects rather than retrying them without credentials, unless such redirects are explicitly required by the API contract. 5. Set a small maximum redirect count to prevent redirect loops and unnecessary authenticated requests. 6. Add regression tests with a local HTTP server that verifies: - Same-origin redirects follow the intended policy. - Cross-origin redirects are rejected. - Authorization headers never reach a different origin. - HTTPS-to-HTTP redirects are rejected. 7. Rotate the API key if logs or runtime evidence indicate that a cross-origin redirect has already occurred. ]]>