other
Error
- Location
scripts/twitter_client.py:125- Finding
Transmission of X Account, MFA, and Proxy Credentials to a Third-Party API
- Content
View full analysis
Dict[str, Any]: """Login to Twitter account.""" data = { "user_name": username, "email": email, "password": password, "proxy": proxy } if totp_code: data["totp_code"] = totp_code return self._request("POST", "/twitter/user_login_v3", data=data) ``` The documentation explicitly directs users to submit these credentials: ```bash curl -X POST "https://api.aisa.one/apis/v1/twitter/user_login_v3" \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"user_name":"myaccount","email":"me@example.com","password":"xxx","proxy":"http://user:pass@ip:port"}' ``` ### Technical Analysis The login implementation collects an X username, email address, password, proxy URL, and optional TOTP code and sends them in a JSON request to `api.aisa.one`. This hostname is an intermediary service rather than an official X authentication endpoint. The proxy URL may itself contain reusable authentication credentials, as shown by the documented `http://user:pass@ip:port` format. Consequently, one request can disclose: - The primary X account password - The account email and username - A currently valid MFA code - Proxy service credentials - The SkillBoss bearer API key in the authorization header HTTPS protects data in transit from passive network interception, but it does not protect the secrets from the receiving service. The intermediary necessarily receives the plaintext request body after TLS termina ...[truncated 2036 chars]- Remediation
View remediation