Root + Impact

Description

• HTTP requests should be made over secure protocols to prevent MITM (Man-In-The-Middle) attacks and ensure data integrity.

• In this case, the OpenWeatherMap geocoding API is called via HTTP instead of HTTPS, exposing sensitive data like API keys and parameters to potential interception.

Risk

Likelihood:

• This will occur every time a geocoding request is made, as the URL is hardcoded.

• All deployments are affected regardless of environment (testnet or mainnet), unless manually fixed.

Impact:

• API keys and location data can be intercepted in transit.

• Attackers may alter responses, injecting false latitude/longitude values and causing incorrect weather data to be fetched.

Proof of Concept

None

Recommended Mitigation