Description

Detects hardcoded passwords or secrets in DirectoryEntry configurations within C# code. Storing credentials directly in source code is a security risk as it can expose sensitive authentication information through code repositories or application reverse engineering.

Detection Strategy

• Identifies DirectoryEntry.Invoke() method calls in C# code

• Checks if the method call contains string literals representing hardcoded secrets/passwords

• Verifies the call is made on a DirectoryEntry class instance/definition

• Reports a vulnerability when all conditions are met - Invoke() call with hardcoded credentials on DirectoryEntry

Vulnerable code example

using System.DirectoryServices;

class Program {
    static void Main() {
        string password = "123";
        
        // Vulnerable: Hardcoded password passed to SetPassword
        var users = new DirectoryEntry().Children.Add("test", "User");...

✅ Secure code example

using System.DirectoryServices;
using System.Configuration;

class Program {
    static void Main(string[] args) {
        // Get password securely from command line args or config
        string securePassword = args.Length > 0 ? args[0] : ConfigurationManager.AppSettings["UserPassword"];
        ...