Non-encrypted confidential information
Description
Confidential information is stored or transported without adequate encryption.
Impact
Use the obtained information to compromise resources or services.
Recommendation
- Use strong, industry-standard encryption, such as AES-256, for data at rest, and enforce TLS 1.2 or higher (preferably TLS 1.3) for data in transit. - Manage encryption keys through a dedicated KMS, HSM, or through iOS Keychain and Android Keystore. - Note that encoding (e.g., Base64, hex) is not encryption and provides no confidentiality. - Apply masking or tokenization where required by applicable standards. - If the exposure is caused by credentials or secrets hardcoded in source code rather than data at rest, encryption in place is not sufficient. - Remove the credentials from the codebase, rotate them immediately, purge them from git history, and load them from a secrets manager or another secure mechanism.
Threat
Anonymous attacker with access to the system's storage, network traffic, or cloud resources.
Expected Remediation Time
⏱️ 90 minutes.
Details
Why
When secret credentials are compromised, we always generate a vulnerability report either the credentials are mocks, or are functional only in specific scenarios such as local environments. The risk of this scenario is usually considered in the severity tab. For local environment credentials the risk is low but not zero.
Hence to solve this vulnerability we recommend to remove the credentials from the source code, change the compromised credentials and ideally remove the credentials from the git log. In some cases the last recommendation cannot be applied to avoid traceability issues. If that's the case, in addition to removing the credentials from the code, we require a customer confirmation that the credentials were changed to close the vulnerability.
Requirements
134 - Store passwords with salt135 - Passwords with random salt185 - Encrypt sensitive information229 - Request access credentials264 - Request authentication300 - Mask sensitive dataRules
Aws Redshift Encryption DisabledAws Volume Encryption DisabledAws Unencrypted StorageAws Ebs Encryption DisabledAws S3 Server Side Encryption DisabledAws Encryption DisabledHttp Sensitive Fields In Response BodyPhp User Input Storage Sensitive DataJson Yaml Redshift Encryption DisabledRuby Hardcoded Session Secret TokenTypescript Hardcoded Private KeyTerraform Encryption Disabled Or MissingDart Insecure Storage Of Sensitive DataTerraform Unencrypted Ebs Block DeviceScala Hardcoded Key In SecretkeyspecDart Hardcoded Cryptography KeyScala Hardcoded Keyparameter UseRuby Hardcoded Key For TokenPython Hardcoded Aws CredentialsGo Gorm Plaintext Storage Of PasswordGo Sql Plaintext Storage Of PasswordTerraform Server Side Encryption DisabledJson Yaml Server Side Encryption DisabledTypescript Insecure Sensitive Information File StorageTypescript Hardcoded Hmac KeyJson Yaml Ebs Encryption Disabled Launch ConfigDart Get Storage Insecure Data StorageTypescript Weak Password Encoding Base64Dart Clipboard Sensitive DataSwift Sensitive Information CompromisedJavascript Hardcoded Private KeyJava Hardcoded Keyparameter UseJavascript Weak Password Encoding Base64Javascript Hardcoded Hmac KeySwift Sensitive Data In External StorageRuby Hardcoded Encryption KeySwift Local Sensitive InformationSwift Insecure Data No File ProtectionJson Yaml Unencrypted Efs FilesystemC Sharp Hardcoded Connection PasswordJson Yaml Storage Encrypted FalseJavascript Insecure Sensitive Information File StorageJava Null Cipher UsedConfig Files Plaintext Certificate StorageSwift Cloud Information CompromisedScala Spring Plaintext Storage Sensitive DataScala Play Plaintext Storage Sensitive DataTerraform Storage Encrypted FalseC Sharp Insecure Cookie Data StorageDart File Storage Of Sensitive DataC Sharp Hardcoded Cryptographic KeyTerraform Unencrypted Efs Filesystem