T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ql.sh:57- Finding
API Client Secret Exposed in URL Query Parameters and Potentially Transmitted over Plaintext HTTP
- Content
View full analysis
&1) || \ die "Failed to connect to QingLong at ${QL_URL}" ``` The setup documentation explicitly presents HTTP as a valid panel URL: ```markdown | `QINGLONG_URL` | Panel base URL (e.g. `http://192.168.1.100:5700`) | ``` ### Technical Analysis The authentication request places both the client ID and client secret in the URL query string. Query strings are commonly captured by reverse-proxy access logs, HTTP server logs, observability platforms, network debugging tools, and monitoring infrastructure. The script also accepts an arbitrary user-configured URL without requiring HTTPS. When the documented HTTP configuration is used, the client secret, returned access token, bearer tokens, API responses, environment-variable values, scripts, logs, and administrative commands can all cross the network without transport encryption. Sending authentication information to the user-selected QingLong panel is necessary for the declared functionality. However, transmitting a long-lived secret in a query string and permitting plaintext HTTP exceed secure minimum requirements. ### Attack Path 1. A user follows the documentation and configures an HTTP QingLong URL, or places the panel behind a reverse proxy that records complete URLs. 2. The script sends a request containing `client_secret` in the URL query string. 3. A network observer, proxy administrator, local diagnostic tool, or access-log reader captures the URL. 4. The attacker extracts the client ID and secret. 5. The att ...[truncated 731 chars]- Remediation
View remediation