T09 · Insecure Skill Coding Practices
Warning
- Location
- express.py:27
- Finding
- API Credential and Shipment Data Exposed in URL Query Parameters## Vulnerability Details **File Location**: `express.py:27-39` and `express.py:72-75` **Vulnerability Type**: Sensitive information transmitted through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```python params = { "appkey": appkey, "number": req.get("number", ""), "type": req.get("type", "auto"), } mobile = req.get("mobile") if mobile: params["mobile"] = mobile try: resp = requests.get(API_URL, params=params, timeout=10) ``` ```python params = {"appkey": appkey} try: resp = requests.get(TYPE_URL, params=params, timeout=10) ``` ### Technical Analysis Passing `params` to `requests.get()` serializes the supplied values into the request URL. Consequently, the `JISU_API_KEY` credential appears in the query string for both API operations. Tracking requests additionally place the shipment number, carrier type, and optional phone-number suffix in the URL. HTTPS protects the URL against passive interception while it is in transit, but it does not prevent the complete URL from being recorded by the API provider, reverse proxies, gateways, monitoring platforms, debugging tools, or access logs. Query parameters are commonly retained in such systems, potentially beyond the lifetime intended for the credential or shipment data. Exploitation requires an attacker to obtain access to infrastructure or application records containing the generated request URLs. The finding does not independently grant system privileges or demonstrate compromise of the API provider. ### Attack Path 1. A user invokes the skill with a shipment number and, where required, a phone-number suffix. 2. The script reads `JISU_API_KEY` from the environment. 3. `requests.get()` serializes the credential and shipment fields into the URL query string. 4. An intermediary, monitoring platform, debugging facility, or API access-log system records the complete URL. 5. An unauthorized party with a ...[truncated 784 chars]
- Remediation
- ## Remediation Suggestions 1. If supported by JisuAPI, move the API credential to an authorization header rather than placing it in the query string. 2. If the service supports POST requests, send shipment details in the request body instead of the URL. 3. If the upstream API contract requires query parameters, configure all proxies, gateways, logging systems, and observability platforms to redact `appkey`, `number`, and `mobile` values before storage. 4. Never log prepared request URLs or complete `requests` request objects without applying field-level redaction. 5. Use a restricted API key with only the permissions required for shipment queries, enforce usage limits where available, and rotate the key periodically. 6. Revoke and replace the key if there is reason to believe URLs containing it have already been retained in accessible logs. 7. Minimize retention of shipment data and restrict access to operational logs using least-privilege controls.