T09 · Insecure Skill Coding Practices
Warning
- Location
- enterprisecontact.py:31
- Finding
- API Credential Transmitted in URL Query Parameters## Vulnerability Details **File Location**: `enterprisecontact.py`, lines 31–41 **Vulnerability Type**: API credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```python params = {"appkey": appkey} if company not in (None, ""): params["company"] = company if creditno not in (None, ""): params["creditno"] = creditno if regno not in (None, ""): params["regno"] = regno if orgno not in (None, ""): params["orgno"] = orgno try: resp = requests.get(QUERY_URL, params=params, timeout=10) ``` ### Technical Analysis The value of `JISU_API_KEY` is assigned to the `appkey` query parameter and passed to `requests.get`. The `requests` library serializes this parameter into the request URL, producing a URL equivalent to: ```text https://api.jisuapi.com/enterprisecontact/query?appkey=SECRET&company=... ``` HTTPS encrypts the request while it is in transit, so passive network observers cannot normally read the URL. However, placing a credential in a URL increases its exposure because complete URLs may be retained by the API provider, reverse proxies, gateways, application performance monitoring systems, debug traces, or HTTP access logs. This issue does not expose the key directly to arbitrary remote users by itself. Exploitation requires access to infrastructure or diagnostic records that capture the complete request URL. ### Attack Path 1. An operator configures a valid API credential in the `JISU_API_KEY` environment variable. 2. A user invokes the enterprise contact query. 3. The skill places the credential in the `appkey` URL query parameter. 4. An intermediary, API endpoint, monitoring service, or diagnostic facility records the complete request URL. 5. An attacker with access to those records extracts the `appkey` value. 6. The attacker submits requests directly to the JisuAPI service using the compromised credential. ### Impact Asses ...[truncated 516 chars]
- Remediation
- ## Remediation Suggestions 1. If the API supports it, transmit the credential in an authorization header rather than in the URL: ```python params = {} headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get( QUERY_URL, params=params, headers=headers, timeout=10, ) ``` 2. If the provider mandates an `appkey` query parameter, apply compensating controls: - Disable or redact query-string logging in reverse proxies, gateways, monitoring agents, and application logs. - Ensure exception and debug telemetry never records prepared request URLs. - Restrict access to API-provider and infrastructure logs. - Use a dedicated key with the minimum available permissions and quota. - Rotate the key periodically and immediately after suspected disclosure. - Configure provider-side usage limits or source restrictions where available. - Document that the external API protocol requires the credential to appear in the request URL. 3. Avoid printing request objects, prepared URLs, or parameter dictionaries because they contain the credential. 4. Add automated secret-redaction tests covering `appkey` in URLs, logs, exceptions, and telemetry.