T09 · Insecure Skill Coding Practices
- Location
references/admin_division_query.md:19- Finding
Hardcoded Baidu Maps API Credential in Administrative Division Reference
- Content
View full analysis
Vulnerability Details
File Location:
references/admin_division_query.md:19
Vulnerability Type: Hardcoded API credential
Risk Level: MediumVulnerable Code
markdown | ak | string | T | - | 开发者密钥，即API Key，用于身份验证和配额管理。 | E4805d16520de693a3fe707cdc962045 |Technical Analysis
The API parameter example contains a concrete value with the format and placement of a Baidu Maps access key rather than an unmistakable placeholder. The repository does not establish whether this credential is synthetic, expired, or revoked. It must therefore be treated as potentially exposed.
Hardcoded credentials in public documentation can be copied directly or collected through automated secret scanning. If the key remains active, an attacker can use it to invoke Baidu Maps services enabled for the associated application. The key is transmitted as the
akquery parameter, so it may also be propagated into generated code, command histories, request logs, proxy logs, and monitoring systems.Attack Path
- An attacker reads
references/admin_division_query.mdor discovers the value through automated repository scanning. - The attacker extracts
E4805d16520de693a3fe707cdc962045. - The attacker submits requests containing the extracted value as the
akparameter to compatible Baidu Maps endpoints. - If the credential is active and the request satisfies its IP or signature restrictions, the attacker consumes the application's API quota or accesses services enabled for that key.
- Repeated or abusive requests may exhaust quota or trigger provider-side throttling, suspension, or billing consequences.
Exploitation depends on the credential remaining valid and on its configured restrictions.
Impact Assessment
The potential scope is limited to Baidu Maps services and quotas authorized for the exposed application key. An attacker may consume API quota, obtain API responses available under the key, cause serv ...[truncated 348 chars]
- An attacker reads
- Remediation
View remediation
Remediation Suggestions
- Replace the concrete value with an unmistakable placeholder such as
$BMAP_WEBAPI_AKorYOUR_BAIDU_MAP_AK. - Verify the credential in the Baidu Maps developer console. Revoke and rotate it immediately if it was ever active.
- Search repository history, generated documentation, release artifacts, logs, and mirrors for the same value and remove it where feasible.
- Restrict replacement credentials using source-IP allowlists, service-level permissions, quotas, and request-signature validation where supported.
- Add automated secret scanning to pre-commit hooks and continuous integration checks.
- Ensure examples consistently obtain credentials from
BMAP_WEBAPI_AKand never print or log complete request URLs containing the key.
- Replace the concrete value with an unmistakable placeholder such as