T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/global_news_fetcher.py:33
- Finding
- API Credentials Exposed Through URL Query Parameters<![CDATA[ ## Vulnerability Details **File Location**: `scripts/global_news_fetcher.py`, lines 33–40 and 68–75 **Vulnerability Type**: API credential exposure through URL query strings **Risk Level**: Low ### Vulnerable Code ```python params = { "language": "en", "country": "US,GB,JP,KR", "limit": limit, "apiKey": self.currents_key } response = requests.get(url, params=params, timeout=10) ``` ```python params = { "topic": "technology", "lang": "en", "country": "us", "max": limit, "token": self.gnews_key } response = requests.get(url, params=params, timeout=10) ``` ### Technical Analysis The script reads `CURRENTS_API_KEY` and `GNEWS_API_KEY` from environment variables and supplies them as query parameters in HTTPS GET requests. The credentials are sent only to the corresponding hard-coded Currents and GNews endpoints, so the behavior supports the declared news-fetching functionality and is not evidence of malicious exfiltration. Nevertheless, credentials in URL query strings can be recorded in reverse-proxy logs, API gateway logs, network-monitoring systems, server access logs, or diagnostic output. HTTPS protects the URL while it is in transit but does not prevent endpoints and authorized intermediaries from logging the complete request target. ### Attack Path 1. A legitimate Skill execution sends a request containing the API key in the query string. 2. A server, proxy, gateway, or monitoring component records the complete request URL. 3. An attacker obtains access to those logs through a separate compromise, excessive log permissions, or accidental log disclosure. 4. The attacker extracts the `apiKey` or `token` value. 5. The attacker reuses the credential against the corresponding API until the key is revoked, restricted, or rate-limited. This path requires access to infrastructure capable of observing or retaining the request URL; the code does not intentionally send credentials to an unrelated destination. ### ...[truncated 499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use an authorization header instead of a query parameter if the relevant API supports header-based authentication. 2. If query-parameter authentication is mandatory, configure all proxies, gateways, monitoring tools, and server logs to redact `apiKey` and `token`. 3. Do not include complete request URLs in application logs or exception messages. 4. Apply provider-supported key restrictions, rate limits, quota alerts, and expiration policies. 5. Store the credentials only in an approved secret manager or protected environment variables. 6. Rotate credentials if request URLs may already have been retained in accessible logs. ]]>