T09 · Insecure Skill Coding Practices
Warning
- Location
- etf-monitor.py:29
- Finding
- Market Data Retrieved over Unauthenticated Plaintext HTTP## Vulnerability Details **File Location**: `etf-monitor.py`, lines 29-31 **Vulnerability Type**: Unauthenticated plaintext network communication **Risk Level**: Medium **Vulnerable Code**: ```python url = f"http://qt.gtimg.cn/q={symbols}" resp = requests.get(url, timeout=10) ``` ### Technical Analysis The application obtains the market prices used for alert decisions through plaintext HTTP. HTTP provides no server authentication or transport integrity, allowing an attacker with a network interception position to observe or modify the response. The script immediately parses the returned values and uses them to calculate price changes without independently validating the response origin, quote timestamp, symbol association, or plausible price range. A forged response can therefore directly influence whether an alert is generated. ### Attack Path 1. The Skill runs on a network that an attacker can intercept, such as a compromised gateway, hostile access point, proxy, or DNS environment. 2. The script requests ETF data from `http://qt.gtimg.cn`. 3. The attacker intercepts the request and returns a syntactically valid but manipulated quote response. 4. The script accepts the forged current and closing prices. 5. The manipulated values produce false alerts or suppress alerts for genuine market movements. ### Impact Assessment Exploitation does not directly grant local system privileges or code execution. Its scope is the integrity and reliability of all market-monitoring results produced by the Skill. An attacker can create false alerts, suppress legitimate alerts, and mislead downstream users or automated notification workflows that rely on the generated JSON.
- Remediation
- ## Remediation Suggestions - Replace the endpoint with an HTTPS-supported market-data API and retain normal TLS certificate verification. - Do not disable certificate or hostname validation to preserve compatibility. - If this provider does not offer HTTPS, migrate to a trusted provider that does. - Validate the response status and expected content before parsing: ```python resp = requests.get(https_url, timeout=10) resp.raise_for_status() ``` - Validate returned symbols, quote timestamps, field counts, numeric ranges, and other invariants before using the data. - Treat malformed, stale, or implausible responses as data-source failures rather than valid zero-change results.