django-tastypie ApiKeyAuthentication Vulnerability Allowing Credential Exposure via URL Parameters

A vulnerability exists in django-tastypie versions through 0.15.1, specifically within the ApiKeyAuthentication function in authentication.py. This issue allows for the remote exploitation of GET or POST request methods to include sensitive query strings, such as API credentials. The vulnerability arises from the authentication method's acceptance of credentials via URL parameters when no Authorization header is provided, potentially leading to API key leakage.

Impact

Exploiting this vulnerability allows for API keys to be extracted from the application's access logs, browser history, referrer headers, and shared URLs. This could enable unauthorized users to impersonate the API key owner.

Reproduction

To reproduce this vulnerability, use django-tastypie version 0.15.1 and authenticate an API request by including the 'username' and 'api_key' parameters in the URL or as POST fields, instead of using the 'Authorization' header'.

Remediation

It is recommended to remove the fallback for GET/POST credential acceptance in ApiKeyAuthentication, or to require an explicit opt-in for this feature. Throttle management should be improved with atomic cache operations to prevent bypassing rate limits.