T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/query_stock.py:56
- Finding
- Unauthenticated Plaintext HTTP Allows Stock Quote Tampering## Vulnerability Details **File Location**: `scripts/query_stock.py`, lines 56–59 **Vulnerability Type**: Unauthenticated plaintext HTTP transport **Risk Level**: Medium ### Vulnerable Code ```python resolved = [resolve_code(c) for c in codes] url = f"http://qt.gtimg.cn/q={urllib.parse.quote(','.join(resolved))}" try: with urllib.request.urlopen(url, timeout=10) as resp: raw = resp.read() ``` ### Technical Analysis The script retrieves financial data from Tencent Finance over plaintext HTTP. HTTP does not authenticate the server or protect the response's integrity and confidentiality. Although the query values are URL-encoded, URL encoding provides no transport security. The application parses the response without cryptographic integrity checks and presents its fields as trusted market data. A network-positioned attacker can therefore read requested stock symbols, intercept the request, and substitute a forged response in the format expected by the parser. This issue does not enable local code execution or privilege escalation based on the reviewed code. It compromises the confidentiality and integrity of network requests and financial results. ### Attack Path 1. A user invokes the Skill with one or more stock symbols. 2. The script sends a plaintext HTTP request to `qt.gtimg.cn`. 3. An attacker controlling or observing a network intermediary—such as a malicious Wi-Fi access point, proxy, router, or compromised gateway—intercepts the request. 4. The attacker returns a forged response containing the expected `v_...="...~..."` structure. 5. The script decodes and parses the response without authenticating its origin or validating its integrity. 6. Manipulated prices, percentage changes, market capitalization values, company names, or other financial metrics are displayed as legitimate data. ### Impact Assessment A successful attacker can: - Observe which stock symbols the user queries. - Modify or fabricate stock quote responses. - Misle ...[truncated 407 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext endpoint with an HTTPS endpoint from the provider and rely on standard certificate and hostname validation: ```python url = f"https://qt.gtimg.cn/q={urllib.parse.quote(','.join(resolved))}" ``` 2. Confirm that the HTTPS endpoint is officially supported and returns the expected data before deployment. Do not disable TLS certificate validation or accept invalid certificates. 3. If Tencent does not provide a supported HTTPS endpoint, migrate to a reputable market-data provider that offers authenticated HTTPS transport, or place a controlled HTTPS relay in front of the upstream service. 4. If plaintext upstream communication is unavoidable, clearly warn that responses are unauthenticated and must not be used as the sole basis for trading or other consequential decisions. 5. For higher-assurance use cases, validate quote data against an independent authenticated source and reject malformed or implausible responses rather than displaying them as trusted results.