T09 · Insecure Skill Coding Practices
Warning
- Location
- shouji.py:24
- Finding
- API Credential Exposed in URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `shouji.py`, lines 24–33 **Vulnerability Type**: API credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```python params = {"appkey": appkey} number = req.get("shouji") if not number: return { "error": "missing_param", "message": "shouji is required", } params["shouji"] = number try: resp = requests.get(SHOUJI_QUERY_URL, params=params, timeout=10) ``` ### Technical Analysis The API key is assigned to the `appkey` query parameter and passed to `requests.get`. The `requests` library serializes this dictionary into a URL similar to: ```text https://api.jisuapi.com/shouji/query?appkey=<API_KEY>&shouji=<PHONE_NUMBER> ``` HTTPS protects the request from passive interception while it is in transit, but it does not prevent the complete URL from being recorded at either endpoint or by trusted infrastructure. Query strings may appear in reverse-proxy access logs, API gateway logs, server telemetry, debugging output, exception reports, or monitoring systems. Consequently, personnel or systems with access to those records may obtain the API credential. The same URL also contains the submitted phone number, although the credential represents the primary security concern in this finding. ### Attack Path 1. A user invokes the skill with a phone number. 2. The skill reads `JISU_API_KEY` from the environment. 3. The skill places the credential and phone number in the request query string. 4. A reverse proxy, API gateway, endpoint server, or diagnostic system records the complete request URL. 5. An attacker or unauthorized operator with access to the relevant logs extracts the `appkey` value. 6. The attacker reuses the key to issue requests within the permissions and quota assigned to that credential. This path requires access to infrastructure or diagnostic records that retain query strings; it does not provide direct local code execution. ### ...[truncated 701 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an authentication header if the API provider supports one: ```python headers = {"Authorization": f"Bearer {appkey}"} params = {"shouji": number} resp = requests.get( SHOUJI_QUERY_URL, headers=headers, params=params, timeout=10, ) ``` 2. If the provider supports only the documented `appkey` query parameter: - Configure clients, reverse proxies, API gateways, monitoring tools, and error-reporting systems to redact `appkey` and query strings. - Ensure application logs never emit the prepared request URL. - Restrict access to access logs and diagnostic records. - Apply short retention periods and encryption to logs that may contain request URLs. 3. Use a dedicated, least-privileged API key for this skill. Do not reuse the credential across unrelated services or environments. 4. Configure provider-side restrictions where available, such as permitted APIs, source IP allowlists, rate limits, usage alerts, and spending limits. 5. Rotate the current key if it may already have appeared in logs. Review historical gateway and endpoint records for unauthorized disclosure or usage. 6. Document that phone numbers are transmitted to an external service and apply equivalent redaction controls to the `shouji` query parameter. ]]>