T09 · Insecure Skill Coding Practices
Warning
- Location
apis/crm.md:480- Finding
API Key Exposure Through a Deprecated URL Query Parameter
- Content
View full analysis
Vulnerability Details
File Location:
apis/crm.md, lines 480–488
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: MediumVulnerable Code
bash ## Authentication API key via header or query parameter. ```bash curl https://api.apollo.io/api/v1/auth/health \ -H "X-Api-Key: $APOLLO_API_KEY" # Or via query param (deprecated) curl "https://api.apollo.io/api/v1/auth/health?api_key=$APOLLO_API_KEY"text ### Technical Analysis The deprecated example expands the live `APOLLO_API_KEY` environment variable directly into a URL. Sensitive values embedded in URLs can be retained in shell history, command-line audit records, process-monitoring output, HTTP proxy and gateway logs, provider access logs, observability platforms, and debugging traces. This example is unnecessary because the same section already provides the safer `X-Api-Key` header authentication method. It also contradicts the project's guidance in `auth.md`, which explicitly states that API keys in URLs may be cached by proxies or CDNs and exposed through logs. The request uses HTTPS, which protects the key in transit against passive network interception, but TLS does not prevent disclosure through endpoint, intermediary, or local command logging. ### Attack Path 1. A user exports a valid Apollo API key as `APOLLO_API_KEY`. 2. The user copies and executes the deprecated query-parameter example. 3. The shell expands `$APOLLO_API_KEY`, placing the real credential in the command URL. 4. The URL is retained in one or more local, intermediary, observability, or provider logging systems. 5. An attacker or unauthorized operator with access to those records extracts the key. 6. The attacker submits authenticated requests to Apollo using the exposed key. 7. Access continues until the key expires, is revoked, or is rotated. ### Impact Assessment An exposed key can grant unauthorized access to Apollo resources and operations permitted by that key. Th ...[truncated 419 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the deprecated query-parameter authentication example entirely.
- Document only header-based authentication:
bash curl https://api.apollo.io/api/v1/auth/health \ -H "X-Api-Key: $APOLLO_API_KEY"- Add an explicit warning that credentials must not be placed in URLs because URLs are commonly logged and cached.
- Recommend scoped, least-privilege API keys rather than broadly privileged account keys.
- Recommend immediate rotation if a real key has been used in the deprecated example or exposed in logs.
- Review and sanitize shell history, proxy logs, CI logs, monitoring records, and debugging traces that may contain expanded query-string credentials.
- Ensure examples and operational tooling redact sensitive query parameters and authentication headers from logs.