T09 · Insecure Skill Coding Practices
Error
- Location
- config.json:2
- Finding
- Hardcoded Kuaidi100 API Credentials and Phone Suffix in Version-Controlled Configuration<![CDATA[ ## Vulnerability Details **File Location**: `config.json:2-4` **Vulnerability Type**: Hardcoded credentials and plaintext sensitive data **Risk Level**: High ### Vulnerable Code ```json { "key": "UwIElcfk8572", "customer": "9BA56EAFFAA38573F89722993EA5875C", "default_phone": "1112" } ``` ### Technical Analysis The project stores an active-looking Kuaidi100 API key, customer identifier, and default phone-number suffix directly in a version-controlled plaintext file. `scripts/track.py` loads these values from `config.json`, uses the API key and customer identifier to generate request signatures, and sends the resulting authenticated request to Kuaidi100. Any party able to download or inspect the project can recover these values without authentication. Moving or deleting the file in a later revision would not be sufficient if it remains in repository history, release archives, caches, or previously distributed copies. The phone suffix is also personal linkage data used for certain courier queries. Although it is only four digits, storing it alongside authenticated API credentials increases the likelihood that it can be associated with a specific customer or shipment account. ### Attack Path 1. An attacker downloads the Skill package or obtains access to its source history. 2. The attacker opens `config.json` and extracts the `key`, `customer`, and `default_phone` values. 3. The attacker reproduces the signing process implemented in `scripts/track.py`: - Serialize the Kuaidi100 request parameters. - Concatenate the serialized parameters, API key, and customer identifier. - Calculate the MD5 signature expected by the API. 4. The attacker submits authenticated tracking requests to the Kuaidi100 endpoint using the exposed account identity. 5. The attacker may consume the account's API quota and query shipment information where valid tracking details and any required phone suffix are available. No evidence establishes that the credent ...[truncated 804 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed Kuaidi100 API key and customer credentials. 2. Determine whether the values have appeared in repository history, build artifacts, logs, release archives, or external mirrors. Remove them where possible, while still treating them as permanently compromised. 3. Replace `config.json` with a non-sensitive template such as: ```json { "key": "YOUR_API_KEY", "customer": "YOUR_CUSTOMER_ID", "default_phone": "" } ``` 4. Load real credentials from environment variables or a dedicated secret manager rather than a tracked file. 5. Add the local secret-bearing configuration file to `.gitignore` and ensure restrictive filesystem permissions. 6. Do not store the phone suffix by default. Request it only when needed or retrieve it from an appropriately protected secret source. 7. Add automated secret scanning to commits and release pipelines. 8. Review Kuaidi100 account usage for unexpected requests or quota consumption and rotate any related credentials if suspicious activity is identified. ]]>