logo

Database

Non-encrypted confidential information

Need

Secure storage and encryption of confidential information and credentials

Context

• Requirement of PHP 5.6 or later for running the application

• Usage of php-ldap for LDAP (Lightweight Directory Access Protocol) integration in PHP applications

• Usage of PHP for server-side scripting and web development

• Usage of base64 for encoding and decoding data in base64 format

Description

1. Non compliant code

<?php

// Scenario 1: LDAP service credentials in plain text
$config = [
    'host' => 'ldap.example.com',
    'port' => '389',
    'username' => 'admin',
    'password' => 'password123'...

**LDAP service credentials in plain text.** The LDAP server's host, port, username, and password are stored in plain text in the array `$config`, which is then used with `ldap_connect()`/`ldap_bind()`. Anyone with access to the code — including anyone who can read its version-control history — can read these credentials directly. **Credentials encoded (not encrypted) in Base64.** The username and password are passed through `base64_encode()`. Base64 is a publicly known, trivially reversible encoding, not an encryption scheme, so an attacker with access to the source can decode the credentials just as easily as if they were in plain text. **Confidential information encoded (not encrypted) in hexadecimal.** A confidential string is converted to hexadecimal with `bin2hex()`. As with Base64, this only obfuscates the data — an attacker can trivially convert it back to plain text — and provides no real protection if it is transmitted or stored this way.

2. Steps

• Remove hard-coded and Base64/hexadecimal-"encoded" credentials and confidential information from the source code.

• Store credentials and configuration in environment variables or a secure, encrypted configuration file/database that is not included in the version control system.

• Encrypt confidential information using a strong encryption function (e.g. PHP's openssl_encrypt with AES-256-CBC) rather than relying on encoding schemes such as Base64 or hexadecimal.

• Generate encryption keys and IVs securely (e.g. openssl_random_pseudo_bytes) and never hard-code them into the application.

• Use secure methods to retrieve and decrypt credentials/information only when needed.

• Consider using a secure password hashing algorithm instead of reversible encoding for storing passwords.

• Implement proper access controls and permissions to prevent unauthorized access to the credentials or configuration file.

3. Secure code example

<?php

// Scenario 1: LDAP service credentials from environment variables
$config = [
    'host' => env('LDAP_HOST'),
    'port' => env('LDAP_PORT'),
    'username' => env('LDAP_USERNAME'),
    'password' => env('LDAP_PASSWORD')...

**LDAP service credentials.** Instead of hard-coding the LDAP credentials, they are retrieved via Laravel's `env()` function from environment variables (`LDAP_HOST`, `LDAP_PORT`, `LDAP_USERNAME`, `LDAP_PASSWORD`) defined in the application's `.env` file, which must never be committed to version control. For extra protection, the values in `.env` can themselves be encrypted and decrypted on retrieval. **Credentials.** Rather than Base64-encoding the credentials in the source, they are loaded at runtime from a secure, encrypted configuration file (`parse_ini_file('/path/to/secure/config.ini')`) that is stored outside the source tree and inaccessible to unauthorized users. Passwords should ultimately be hashed with a secure algorithm rather than reversibly encoded/encrypted where hashing is applicable. **Confidential information.** Instead of `bin2hex()`, the data is encrypted with `openssl_encrypt()` using AES-256-CBC, with a randomly generated key and IV (`openssl_random_pseudo_bytes()`). The result is then hex-encoded purely for safe display/transport — the actual protection comes from the AES encryption, not the encoding. The key and IV must be kept secret, generated per use, and never hard-coded, and decryption (`openssl_decrypt()`) should only happen when strictly necessary.