T09 · Insecure Skill Coding Practices
Error
- Location
- gsdata_adapter.py:24
- Finding
- Credential-Derived Authentication Material Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `gsdata_adapter.py:24`, `gsdata_adapter.py:203-213`, `gsdata_adapter.py:408-410`, and `gsdata_adapter.py:453-460` **Vulnerability Type**: Plaintext transmission of sensitive authentication material **Risk Level**: High ### Vulnerable Code ```python DEFAULT_BASE_URL = "http://databus.gsdata.cn:8888/api/service" ``` ```python def make_sign(params: Dict[str, Any], app_secret: str) -> str: # GSData signature: md5(app_secret + "_" + sorted(kv concat) + "_" + app_secret) sorted_items = sorted(params.items(), key=lambda x: x[0]) concat = "".join(f"{k}{v}" for k, v in sorted_items) raw = f"{app_secret}_{concat}_{app_secret}" return hashlib.md5(raw.encode("utf-8")).hexdigest() def make_access_token(app_key: str, sign: str, router: str) -> str: return base64.b64encode(f"{app_key}:{sign}:{router}".encode("utf-8")).decode( "utf-8" ) ``` ```python sign = make_sign(params, self.app_secret) token = make_access_token(self.app_key, sign, route) headers = {"access-token": token} ``` ```python def _request( self, method: str, params: Dict[str, Any], headers: Dict[str, str] ) -> requests.Response: # GSData gateway commonly accepts params in query/body against one base URL. if method == "POST": return requests.post( self.base_url, data=params, headers=headers, timeout=30 ) return requests.get(self.base_url, params=params, headers=headers, timeout=30) ``` ### Technical Analysis The adapter defaults to an unencrypted `http://` GSData endpoint. Every non-dry-run request includes an `access-token` containing the application key, a secret-derived MD5 signature, and the selected API route. Request parameters are also transmitted in either the URL query string or POST body. Base64 is only reversible encoding and provides no confidentiality. Although the application secret itself is n ...[truncated 1665 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the default endpoint with an official HTTPS endpoint. 2. Reject any base URL whose scheme is not `https`. 3. Retain TLS certificate verification and do not introduce `verify=False`. 4. Consider pinning or allowlisting the expected GSData hostname. 5. Fail closed if HTTPS is unavailable rather than falling back to plaintext HTTP. 6. If the GSData protocol supports it, migrate from MD5-based signing to a modern construction such as HMAC-SHA-256. 7. Confirm that the server enforces short validity periods, nonces, timestamps, and replay protection for signed requests. 8. Avoid placing sensitive query data in URL parameters where the API permits use of protected POST bodies.