T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/message.js:90
- Finding
- Kim application secret transmitted in a URL query string## Vulnerability Details **File Location**: `scripts/message.js:90-93` **Vulnerability Type**: Sensitive information in URL query strings (CWE-598) **Risk Level**: Medium **Vulnerable Code**: ```javascript async function getAccessToken(appKey, secretKey) { const params = new URLSearchParams({ appKey, secretKey }); const url = `${BASE_URL}/token/get?${params}`; const raw = await httpsGet(url); ``` ### Technical Analysis The application key and secret key are encoded directly into the token endpoint URL. TLS protects the request while it is in transit, but it does not prevent the complete URL from being recorded by the destination server, reverse proxies, API gateways, network-observability systems, or error-reporting infrastructure. Query parameters are commonly included in access logs and tracing metadata. Consequently, a system that legitimately records request URLs may inadvertently retain the Kim secret key. This creates an additional credential disclosure surface beyond the local credential files and environment variables. ### Attack Path 1. A legitimate user invokes `scripts/message.js` or `scripts/send.sh`. 2. The script constructs a request URL containing both `appKey` and `secretKey`. 3. A gateway, reverse proxy, application server, tracing system, or monitoring platform records the request URL. 4. An attacker or unauthorized operator obtains read access to those logs or traces. 5. The attacker extracts the application credentials from the `appKey` and `secretKey` query parameters. 6. The attacker requests an access token from the Kim token endpoint and uses the resulting authorization within the permissions assigned to the compromised Kim application. ### Impact Assessment Successful exploitation discloses the Kim application credentials. An attacker may authenticate as the configured application and exercise its authorized Kim API capabilities, including sending messages to users within the appl ...[truncated 267 chars]
- Remediation
- ## Remediation Suggestions - Prefer an API mechanism that places credentials in an authorization header or HTTPS POST body rather than in the URL. - If the Kim API mandates query-string authentication, configure every involved gateway, proxy, server, tracing service, and monitoring system to redact the `appKey` and `secretKey` parameters. - Disable unnecessary URL logging for the token endpoint and restrict access to unavoidable logs according to least privilege. - Set short retention periods for logs that could contain authentication material. - Use narrowly scoped application credentials and rotate the current secret after deploying the hardened implementation. - Ensure errors expose only HTTP status information or sanitized response data and never include the complete token endpoint URL.