T09 · Insecure Skill Coding Practices
- Location
scripts/import_to_nocodb.py:14- Finding
Hard-Coded Live NocoDB API Credential and Fixed Remote Destination
- Content
View full analysis
Vulnerability Details
File Location:
scripts/import_to_nocodb.py, lines 14-21
Vulnerability Type: Hard-coded API credential and insecure secret management
Risk Level: HighVulnerable Code
python # NocoDB 配置 - UAT 环境 BASE_URL = "https://nocodb.dixchain.com/api/v2" TOKEN = "TNejcEzKlX92OU0tfp3NW9PDelevPvBadZ0j-A-3" TABLE_ID = "m2w6ubg16mcn33m" # UAT 环境表 HEADERS = { "xc-token": TOKEN, "Content-Type": "application/json" }Technical Analysis
The script embeds a concrete NocoDB endpoint, table identifier, and reusable API token directly in distributed source code. Anyone with access to the project can extract the token without executing the script.
This also conflicts with the documented configuration model, which states that users should provide their own NocoDB endpoint, token, and table IDs. The example configuration is not loaded by the import script. Consequently, executing the script sends records from the selected local JSON file to the hard-coded remote NocoDB instance rather than a user-configured destination.
The exact permissions granted by the exposed token cannot be determined from the repository. However, a valid NocoDB token may permit reading, creating, updating, or deleting records depending on its assigned role and scope.
Attack Path
- An attacker obtains a copy of the project or otherwise reads the distributed source code.
- The attacker extracts the hard-coded NocoDB endpoint and API token.
- The attacker submits requests directly to the NocoDB API using the
xc-tokenheader. - The attacker enumerates or accesses resources permitted by that token.
- Depending on token scope, the attacker reads sensitive records, inserts unauthorized data, modifies existing records, or deletes accessible data.
A separate data-disclosure path exists during ordinary use:
- A user invokes
import_to_nocodb.pywith a local JSON file. - The script reads ...[truncated 740 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke the exposed API token immediately and issue a replacement; removing it from the current source tree does not invalidate copies in existing distributions or repository history.
- Remove all real credentials, concrete private endpoints, and production or UAT table IDs from source code.
- Load configuration from a user-controlled file, environment variables, or a supported secret manager.
- Ensure
import_to_nocodb.pyactually consumes the documentednocodb-config.jsonconfiguration instead of silently using a fixed destination. - Require explicit destination confirmation before uploading records, particularly when the endpoint is not local or belongs to another organization.
- Use a least-privilege token restricted to the required table and record operations.
- Add startup validation that rejects placeholder values, unexpected hosts, insecure HTTP endpoints, and malformed table identifiers.
- Keep real configuration files outside version control and provide only sanitized examples.
- Review NocoDB access logs for unauthorized activity performed with the exposed token.