T09 · Insecure Skill Coding Practices
- Location
epc.py:17- Finding
API Credential and VIN Data Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
epc.py, lines 17–22
Vulnerability Type: API credentials and potentially sensitive VIN data transmitted in URL query parameters
Risk Level: Mediumpython all_params = {"appkey": appkey} all_params.update({k: v for k, v in params.items() if v not in (None, "")}) url = f"{BASE_URL}/{path}" try: resp = requests.get(url, params=all_params, timeout=15)Technical Analysis
The application adds
appkeytoall_paramsand passes that dictionary to theparamsargument ofrequests.get. The Requests library serializes these values into the URL query string. Depending on the selected operation, the same URL can also contain a user-supplied VIN.HTTPS encrypts the complete request while it is in transit, but it does not prevent URLs from being recorded at endpoints or within trusted infrastructure. Query strings may be retained by API servers, reverse proxies, gateways, monitoring systems, debugging tools, or application logs. This can disclose both the reusable API credential and queried VIN data to parties with access to those records.
The API destination is declared and appropriate to the Skill's stated purpose; therefore, this is insecure credential transport rather than covert data exfiltration.
Attack Path
- A user configures a valid
JISU_API_KEYand invokes an EPC command. - The Skill creates a GET request containing the API key and request data in its query string.
- An API server, proxy, gateway, monitoring service, or diagnostic component records the complete request URL.
- An attacker or unauthorized operator obtains access to the relevant logs or telemetry.
- The attacker extracts the API key and reuses it to issue requests against the JisuAPI service.
- Where VIN queries were logged, the attacker may also collect or correlate vehicle-identifying information.
Exploitation depends on access to infrastructure that records query s ...[truncated 716 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
-
If JisuAPI supports it, transmit the credential in an authorization header rather than in the URL:
python headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get(url, params=params, headers=headers, timeout=15)Use the exact authentication scheme documented by the provider.
-
If the service requires
appkeyas a query parameter, configure HTTP clients, reverse proxies, gateways, observability platforms, and API infrastructure to redact theappkeyparameter before logging or exporting telemetry. -
Avoid recording complete VIN-bearing URLs. Redact or tokenize the
vinparameter in logs and retain it only where operationally necessary. -
Restrict the API key by source IP, endpoint, permissions, and quota where the provider supports these controls.
-
Rotate the existing key if URLs may already have been logged, and establish periodic rotation and revocation procedures.
-
Apply least-privilege access controls and short retention periods to server, proxy, monitoring, and diagnostic logs.
-
Ensure error handling and debugging output never print the prepared request URL or request parameters containing the key or VIN.
-