T09 · Insecure Skill Coding Practices
- Location
references/data-sources.md:100- Finding
API Key Exposed Through Plaintext HTTP Query Parameter
- Content
View full analysis
Vulnerability Details
File Location:
references/data-sources.md, lines 100-105
Vulnerability Type: API credential exposure through plaintext transport and URL query parameters
Risk Level: MediumVulnerable Code
markdown ### 聚合数据 juhe.cn（个人可用） - 接口：`http://op.juhe.cn/onebox/car/query` - 参数：`key={APPKEY}&car={车型名}` - 费用：按次收费，个人友好 - 申请：https://www.juhe.cnTechnical Analysis
The integration documentation instructs users to call an API over unencrypted HTTP and place the API key in the URL query string. Plaintext HTTP does not provide transport confidentiality or server authentication, so network intermediaries can observe or modify the request.
Even if transport encryption were added, credentials in query strings may be retained in application and proxy access logs, monitoring platforms, browser history, debugging output, and other URL-processing infrastructure. An exposed
APPKEYcould then be replayed independently of the legitimate client.This is documentation rather than executable code, so exploitation requires a user or implementation to follow the insecure integration guidance.
Attack Path
- A developer follows the documented API example.
- The application sends a request to
http://op.juhe.cn/onebox/car/query?key={APPKEY}&car={vehicle}. - A network intermediary, compromised gateway, or logging component captures the complete URL.
- The attacker extracts the API key from the
keyparameter. - The attacker submits requests using the stolen key until it is revoked or its quota is exhausted.
Impact Assessment
An attacker could obtain the exposed third-party API credential and use the privileges assigned to that key. The likely scope includes unauthorized API requests, quota exhaustion, possible usage charges, and access to any API operations authorized for the key. Vehicle query contents may also be disclosed.
This issue does not itself provide local code execution, host access, privilege escalation, ...[truncated 42 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with the provider's verified HTTPS endpoint.
- Use an
Authorizationheader or another provider-supported credential mechanism instead of placing the API key in the query string. - If the provider supports only query-based authentication, require HTTPS and configure applications, proxies, analytics systems, and monitoring tools to redact the
keyparameter. - Store the API key in a secret manager or protected environment variable rather than source files or command-line arguments.
- Apply least-privilege restrictions, quotas, expiration, and source-IP or domain restrictions where supported.
- Rotate any key that may already have been transmitted through the documented HTTP endpoint.
- Update the example to show secure secret handling and explicitly warn against logging credentials.