T09 · Insecure Skill Coding Practices
- Location
vin.py:24- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
vin.py:24-37,vin.py:72-79, andvin.py:114-121
Vulnerability Type: API credential exposure through URL query strings
Risk Level: MediumVulnerable Code
python def query_vin(appkey: str, req: dict): params = {"appkey": appkey} vin = req.get("vin") if vin: params["vin"] = vin strict = req.get("strict") if strict is not None: params["strict"] = strict try: resp = requests.get(VIN_QUERY_URL, params=params, timeout=10)The oil endpoint uses the same pattern:
python params = { "appkey": appkey, "carid": carid, } try: resp = requests.get(VIN_OIL_URL, params=params, timeout=10)The gearbox endpoint also uses this pattern:
python params = { "appkey": appkey, "carid": carid, } try: resp = requests.get(VIN_GEARBOX_URL, params=params, timeout=10)Technical Analysis
Passing
appkeythrough theparamsargument ofrequests.get()serializes the credential into the request URL, for example:text https://api.jisuapi.com/vin/query?appkey=SECRET&vin=...HTTPS encrypts the URL while it is in transit between the client and server, but it does not prevent the complete URL from being recorded at either endpoint or by trusted intermediary infrastructure. Application telemetry, HTTP debugging, reverse proxies, API gateways, server access logs, and exception-reporting systems may retain query strings.
Consequently, the API key is exposed to a broader set of systems and operators than necessary. The same weakness affects all three API operations.
Attack Path
- An operator configures a valid secret in the
JISU_API_KEYenvironment variable. - The Skill reads that value and adds it to the GET request parameter dictionary.
requestsembeds the key in the outgoing URL query string.- A proxy, gateway, server, debugging facility, or telemetry platform records the complete URL.
- An attacker o ...[truncated 908 chars]
- An operator configures a valid secret in the
- Remediation
View remediation
Remediation Suggestions
-
Prefer an API-supported authorization header rather than a URL parameter. For example, if supported by the provider:
python headers = {"Authorization": f"Bearer {appkey}"} params = {"vin": vin, "strict": strict} resp = requests.get(VIN_QUERY_URL, headers=headers, params=params, timeout=10) -
If the provider supports POST-based authentication, place the credential in the request body instead of the URL and continue using HTTPS.
-
If JisuAPI requires
appkeyin the query string:- Disable query-string logging for these endpoints.
- Configure proxies, gateways, observability tools, and error-reporting services to redact
appkey. - Never log prepared request URLs or parameter dictionaries containing the key.
- Restrict the key to only the APIs and source addresses required by this Skill, where provider controls permit it.
- Apply quota and billing alerts to detect unauthorized use.
- Rotate the credential periodically and immediately after suspected exposure.
-
Centralize API request construction and secret redaction so all three operations receive the same protections.
-
Document the provider-imposed residual risk if query-string authentication cannot be replaced.
-