QID 570062

QID 570062: API Keys Exposure Via Parameters

Handling API keys should be thought through carefully during design. The key presents another level of security to the APIs. The keys should not be exposed. Adding API keys as part of parameters would result in credentials being exposed . Analysis of swagger file resulted in determining API keys being added to parameters which is sensitive content exposure. API keys should not be added to path, query parameters.

API Keys can be exposed if they are stored in cookies or passed as parameters. Presence of API keys in parameters results in swagger not being spec compliant and hence results in an error.

CVSS V3 rated as Medium - 3.3 severity.

CVSS V2 rated as Low - 0 severity.

Solution

Remove credentials from URL visible parameters, like query and path parameters. You can use header to save the API keys. For example:

openapi: "3.0" components: securitySchemes: "APIKeyInHeader": type: "APIKey" in: "header"

Vendor References

CVEs related to QID 570062

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].