T09 · Insecure Skill Coding Practices
- Location
enterprisecontact.py:31- Finding
API Credential Transmitted in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
enterprisecontact.py, lines 31–41
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
python params = {"appkey": appkey} if company not in (None, ""): params["company"] = company if creditno not in (None, ""): params["creditno"] = creditno if regno not in (None, ""): params["regno"] = regno if orgno not in (None, ""): params["orgno"] = orgno try: resp = requests.get(QUERY_URL, params=params, timeout=10)Technical Analysis
The value of
JISU_API_KEYis assigned to theappkeyquery parameter and passed torequests.get. Therequestslibrary serializes this parameter into the request URL, producing a URL equivalent to:text https://api.jisuapi.com/enterprisecontact/query?appkey=SECRET&company=...HTTPS encrypts the request while it is in transit, so passive network observers cannot normally read the URL. However, placing a credential in a URL increases its exposure because complete URLs may be retained by the API provider, reverse proxies, gateways, application performance monitoring systems, debug traces, or HTTP access logs.
This issue does not expose the key directly to arbitrary remote users by itself. Exploitation requires access to infrastructure or diagnostic records that capture the complete request URL.
Attack Path
- An operator configures a valid API credential in the
JISU_API_KEYenvironment variable. - A user invokes the enterprise contact query.
- The skill places the credential in the
appkeyURL query parameter. - An intermediary, API endpoint, monitoring service, or diagnostic facility records the complete request URL.
- An attacker with access to those records extracts the
appkeyvalue. - The attacker submits requests directly to the JisuAPI service using the compromised credential.
Impact Asses
...[truncated 516 chars]
- An operator configures a valid API credential in the
- Remediation
View remediation
Remediation Suggestions
-
If the API supports it, transmit the credential in an authorization header rather than in the URL:
python params = {} headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get( QUERY_URL, params=params, headers=headers, timeout=10, ) -
If the provider mandates an
appkeyquery parameter, apply compensating controls:- Disable or redact query-string logging in reverse proxies, gateways, monitoring agents, and application logs.
- Ensure exception and debug telemetry never records prepared request URLs.
- Restrict access to API-provider and infrastructure logs.
- Use a dedicated key with the minimum available permissions and quota.
- Rotate the key periodically and immediately after suspected disclosure.
- Configure provider-side usage limits or source restrictions where available.
- Document that the external API protocol requires the credential to appear in the request URL.
-
Avoid printing request objects, prepared URLs, or parameter dictionaries because they contain the credential.
-
Add automated secret-redaction tests covering
appkeyin URLs, logs, exceptions, and telemetry.
-