T09 · Insecure Skill Coding Practices
- Location
config/qique.config.json:4- Finding
Hardcoded Distribution API Credential in Shipped Configuration
- Content
View full analysis
Vulnerability Details
File Location:
config/qique.config.json:4-5
Vulnerability Type: Hardcoded plaintext secret
Risk Level: High
Classification: T09: Insecure Skill Coding PracticesVulnerable Code
json { "app_id": "", "app_secret": "", "distribution_app_id": "longxiaqique", "distribution_app_secret": "d91f6adabcbe6aaadbfe41162e4777d1" }The corresponding example configuration uses placeholder values, demonstrating that the values in the active configuration are not generic examples:
json { "app_id": "your-app-id", "app_secret": "your-app-secret", "distribution_app_id": "your-distribution-app-id", "distribution_app_secret": "your-distribution-app-secret" }Technical Analysis
A distribution identifier and distribution secret are stored in plaintext in a configuration file shipped with the project. Anyone who obtains the package can recover these values without authentication.
The documented request protocol uses the exposed distribution secret as part of an MD5 request signature:
text sign = md5(appSecret + distributionAppSecret + concat(sorted(k+v)) + appSecret)Consequently, the exposed secret is not merely descriptive configuration; it is authentication material used to construct valid API signatures. The API catalog documents operations involving customer profiles, chat histories, wallet records, orders, appointments, messages, coupons, delivery, and wallet changes.
Exploitation would also require a valid QiQue application credential unless the backend has an independent authentication weakness. Nevertheless, exposing one component of the signing credential materially weakens the authentication scheme and compromises the distribution identity.
Attack Path
- An attacker obtains the distributed Skill package or repository contents.
- The attacker reads
config/qique.config.json. - The attacker recovers the ...[truncated 1295 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed distribution secret immediately.
- Review API access logs for unexpected requests associated with the exposed distribution identity.
- Remove populated credential files from the repository and all distributed artifacts.
- Purge the credential from version-control history where applicable.
- Store the replacement secret in a dedicated secret manager and inject it only at runtime.
- Restrict secret access to the minimum required service identity and tenant.
- Distribute only placeholder configuration templates.
- Add the populated configuration path to ignore rules.
- Enable automated secret scanning in local hooks and CI/CD pipelines.
- Consider replacing the custom MD5 signing design with a modern server-supported authentication mechanism using scoped, revocable, short-lived credentials.