Credentials Leak via GET Request in Ansible Nexmo Module

Executive Summary

This vulnerability exists in the nexmo.py module where the api_key and api_secret credentials are marked as no_log=True to prevent logging, but they are immediately URL-encoded into a GET request as query parameters. This bypasses the no_log protection because the full URL, including sensitive credentials, is exposed.

As a result, the sensitive api_key and api_secret are included in the URL query string, which can be logged or captured by various systems.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to exposure of sensitive credentials (api_key and api_secret) through multiple vectors:

• Ansible verbose output (-vvv) logs the full request URL including credentials.
• Vonage/Nexmo server access logs record the credentials in the query string.
• HTTP proxies, SIEM, and network inspection tools capture the full URL, exposing credentials.
• AWX/Automation Controller network debug logs may also capture these credentials.

This exposure can lead to unauthorized access or misuse of the API credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring logs and network traffic for exposure of sensitive credentials in URLs.

• Check Ansible verbose output logs (using -vvv) for URLs containing api_key and api_secret query parameters.
• Inspect Vonage/Nexmo server access logs for URLs with credentials in the query string.
• Use network inspection tools or HTTP proxies to capture and analyze URLs for exposed api_key and api_secret.
• Review AWX/Automation Controller network debug logs for URLs containing sensitive credentials.

Suggested commands include using grep or similar tools to search logs for 'api_key=' or 'api_secret=' strings, for example: grep -r 'api_key=' /var/log/ansible/

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, switch from sending credentials in the URL query parameters via GET requests to sending them in the request body via POST requests.

Specifically, modify the code to use POST with credentials included in the request body, for example:

• Use data = urlencode({"api_key": api_key, "api_secret": api_secret, "from": src, "to": number, "text": msg})
• Call fetch_url with method="POST" and headers set to "Content-Type": "application/x-www-form-urlencoded"

This prevents credentials from appearing in URLs and logs, reducing exposure through Ansible verbose output, server access logs, HTTP proxies, and network inspection tools.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes sensitive credentials (api_key and api_secret) to be exposed in URLs, which are logged in various places such as Ansible verbose output, Vonage/Nexmo server access logs, HTTP proxies, SIEM, network inspection tools, and AWX/Automation Controller network debug logs.

Exposure of sensitive credentials in logs and network traffic can lead to unauthorized access and data breaches, which may violate data protection requirements under standards like GDPR and HIPAA that mandate protection of sensitive information.

Therefore, this vulnerability negatively impacts compliance with such standards by failing to adequately protect sensitive authentication data.

Useful 0 Not Useful 0