T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat.ts:22- Finding
WeChat session cookie disclosure through weak hostname validation
- Content
View full analysis
{ const headers: Record = { "User-Agent": DESKTOP_UA, Accept: "text/html,application/xhtml+xml", "Accept-Language": "zh-CN,zh;q=0.9", }; if (cookie) headers["Cookie"] = cookie; let resp: Response; try { resp = await withRetry( () => fetch(url, { headers, redirect: "follow" }), { shouldRetry: isRetryableError }, ); } catch { return null; } ``` ### Technical Analysis The handler verifies the hostname using substring matching rather than exact origin matching. Consequently, an attacker-controlled hostname such as: ```text mp.weixin.qq.com.attacker.example ``` passes validation because it contains the string `mp.weixin.qq.com`. If the user has configured `LINKMIND_WXMP_COOKIE`, the handler places the complete cookie value in the `Cookie` request header. The initial request is then sent to the attacker-controlled host. The accepted URL must also have a valid article path, but an attacker can trivially use a path such as `/s/id`. The use of `redirect: "follow"` also creates an additional origin-control concern. Authentication data must never be forwarded to a destination unless every request destination is verified as an approved WeChat origin. ### Attack Path 1. The user configures a WeChat cookie to access restricted content or retrieve article statistics. 2. An attacker supplies a URL such as: ```text https://mp.weixin.qq.com.attacker.example/s/articl ...[truncated 956 chars]- Remediation
View remediation