binance / binance/binance-futures-connector-python

[Security] WebSocket Connection Logs Expose Proxy Credentials

Open
#259 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.2k
Forks
326
PR merge metrics
No merged PRs in 30d

Description

## Bug Name
WebSocket Connection Logs Expose Proxy Credentials

## Attack Scenario
WebSocket manager logs full proxy configuration at DEBUG level in two locations. If users configure authenticated proxies with username/password, proxy credentials appear in plaintext in logs.

## Impact
Proxy credentials in log files exposed to anyone with log access (monitoring systems, log aggregation, shared hosting).

## Components
File: /binance/websocket/binance_socket_manager.py, lines 44-51. Two logging.debug calls with self.proxies. parse_proxies() in utils.py extracts username/password.

## Reproduction
1. Configure WebSocket with authenticated proxy (http://user:pass@proxy:8080).
2. Enable DEBUG logging.
3. Full proxy URL with credentials visible in log output.

## Fix
Sanitize proxy URLs before logging by stripping the userinfo component. Log only the proxy hostname.

## Details
Finding ID: L-01
Severity: Low

---
Researcher: Independent Security Researcher -- Mefai Security Team

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.