T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/get-last-trade.sh:18
- Finding
- API Credential Exposed Through Command-Line URLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get-last-trade.sh:18`, `scripts/get-prev-close.sh:18`, and `scripts/get-agg-day.sh:19` **Vulnerability Type**: API credential disclosure through process arguments and URL query strings **Risk Level**: Medium ### Vulnerable Code `scripts/get-last-trade.sh:18`: ```bash RESP=$(curl -sS "https://api.massive.com/v2/last/trade/${SYMBOL}?apiKey=${KEY}") ``` `scripts/get-prev-close.sh:18`: ```bash RESP=$(curl -sS "https://api.massive.com/v2/aggs/ticker/${SYMBOL}/prev?adjusted=true&apiKey=${KEY}") ``` `scripts/get-agg-day.sh:19`: ```bash RESP=$(curl -sS "https://api.massive.com/v2/aggs/ticker/${SYMBOL}/range/1/day/${DAY}/${DAY}?adjusted=true&sort=asc&limit=5000&apiKey=${KEY}") ``` ### Technical Analysis All three scripts interpolate `MASSIVE_API_KEY` directly into a URL passed as a command-line argument to `curl`. Although HTTPS protects the URL while it is transmitted over the network, it does not prevent local exposure before transmission. While `curl` is running, the full URL may be observable through process inspection interfaces or endpoint-monitoring products. Query strings may also be retained by debugging tools, proxies, URL telemetry, shell tracing, or error-reporting systems. The scripts do not deliberately print the key, but placing it in the URL expands the number of locations in which it can be exposed. ### Attack Path 1. A user invokes one of the market-data scripts with a valid `MASSIVE_API_KEY`. 2. The script expands the key into the URL supplied to `curl`. 3. A local user, monitoring agent, or process-inspection mechanism captures the `curl` command line while it is executing, or an intermediary records the URL. 4. The observer extracts the `apiKey` query parameter. 5. The exposed credential is reused to access the Massive API until it is revoked or expires. ### Impact Assessment An attacker obtaining the key could make API requests under the victim's Massive account, consume su ...[truncated 272 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use Massive's supported authorization-header mechanism instead of placing the credential in the URL query string. 2. Ensure the secret-bearing header is not itself exposed as a process argument. Supply sensitive curl configuration through standard input or another protected mechanism rather than directly using a secret-expanded `-H` argument. 3. Disable verbose shell tracing around credential handling and ensure application, proxy, and diagnostic logs redact authorization information. 4. Keep `MASSIVE_API_KEY` in the process environment only for the minimum required duration. 5. Rotate the existing API key if process telemetry, proxy logs, or diagnostics may already have captured these URLs. 6. Apply restrictive permissions to any dedicated credential file if one is introduced, and never commit it to source control. ]]>