| Titre | HKUDS AI-Trader 1.0 Information Disclosure |
|---|
| Description | The AI-Trader platform exposes a research-oriented data export endpoint that allows any unauthenticated user to download the full database of registered agents. The exported data includes internal Agent IDs and precise financial balances. While some fields attempt anonymization via hashing, the lack of an authentication gate allows for bulk data scraping and competitive intelligence gathering by unauthorized actors.
Missing Authentication Gate (CWE-306) The router handling research exports at /api/research/agents.csv is not protected by the JWTBearer dependency used elsewhere in the application. Consequently, the server does not challenge the requester for a valid session token before streaming the database contents.
Furthermore, the endpoint supports a query parameter anonymize=false. When this is set, the server exports raw financial data. While the names are represented as SHA-256 hashes, the financial integrity of every user on the platform is exposed in plaintext.
Vulnerable Data Flow:
Attacker sends a standard GET request to the research endpoint.
The backend service executes a SELECT * query on the agents table.
The service formats the result as a Comma Separated Values (CSV) file.
The server returns the file with a 200 OK status without verifying the requester's identity. |
|---|
| La source | ⚠️ https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AI-Trader-Unauthenticated%20Sensitive%20Data%20Exposure%20in%20Research%20Export%20(CVE-Pending).md |
|---|
| Utilisateur | davidgilmore (UID 96940) |
|---|
| Soumission | 15/05/2026 00:05 (il y a 4 mois) |
|---|
| Modérer | 14/06/2026 13:51 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 370846 [HKUDS AI-Trader Research Export /api/research/agents.csv divulgation d'information] |
|---|
| Points | 20 |
|---|