T09 · Insecure Skill Coding Practices
- Location
scripts/track.py:20- Finding
API Credential and Tracking Data Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/track.py, lines 20-22 and 37-40
Vulnerability Type: Cleartext transmission of sensitive information
Risk Level: HighVulnerable Code
python try: with open(_key_file, "r") as f: JUHE_KEY = f.read().strip() except: JUHE_KEY = "" JUHE_URL = "http://v.juhe.cn/exp/index"python def query_juhe(tn): """聚合数据查询 —— 主力""" params = urllib.parse.urlencode({"key": JUHE_KEY, "com": "auto", "no": tn.strip()}) req = urllib.request.Request(f"{JUHE_URL}?{params}", headers={"User-Agent": "Mozilla/5.0"}) try: with urllib.request.urlopen(req, timeout=8) as resp: data = json.loads(resp.read().decode("utf-8"))Technical Analysis
The primary Juhe API endpoint uses unencrypted HTTP. The request places both the API credential (
JUHE_KEY) and the user's package tracking number in the URL query string.Because HTTP provides neither transport confidentiality nor endpoint integrity, an attacker capable of observing or modifying network traffic can read these values or alter the API response. URL query parameters may additionally be retained in intermediary proxy, gateway, or diagnostic logs.
No certificate validation or response authenticity mechanism can protect this request while the endpoint remains HTTP. The HTTPS-based fallback does not mitigate the issue because the plaintext Juhe request is attempted first for every query.
Attack Path
- A user invokes shipment tracking with a tracking number.
- The script reads the Juhe API key from
Desktop/999.txt. query_juhe()constructs an HTTP URL containing the API key and tracking number as query parameters.- The request traverses the network without encryption.
- A network-positioned attacker, compromised gateway, or untrusted hotspot captures the URL and obtains both values.
- The attacker may reuse the exposed key to consume the victim's API quota or submit unauthorized API requests ...[truncated 742 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the plaintext endpoint with the provider's official HTTPS endpoint:
python JUHE_URL = "https://v.juhe.cn/exp/index" -
Verify that the provider officially supports HTTPS and fail closed if a secure endpoint is unavailable. Do not silently downgrade to HTTP.
-
Prevent redirects from HTTPS to HTTP, or validate the final response URL before processing the response.
-
Avoid transmitting credentials in URL query strings when the provider supports authorization headers or POST request bodies. This reduces exposure through URL logging.
-
Store the API key in an operating-system credential manager or a permission-restricted configuration source rather than a general Desktop text file.
-
Rotate the existing Juhe API key because it may already have traversed untrusted networks in plaintext.
-
Treat tracking numbers as sensitive personal metadata and document the external services to which they are transmitted.
-
Add a regression test that rejects any API endpoint whose parsed scheme is not
https.
-