Non-encrypted confidential information
Description
Confidential information, such as payment card data, database records, files on local/mobile storage, backups/snapshots, or cloud resources (e.g., S3, EFS, EBS, DynamoDB, RedShift), is stored or transported without adequate encryption, is encoded (e.g., Base64, hex) instead of encrypted, or is encrypted using a shared/default key instead of a customer-managed key, allowing an attacker with access to the storage, network, or affected resource to view it in plain text.
Impact
Obtain sensitive information, such as credit card data, database contents, or cloud resource contents, that can compromise system resources or violate data-protection standards such as PCI DSS.
Recommendation
- Use AES-256 for data at rest and enforce TLS 1.2 or higher (preferably TLS 1.3) for data in transit, including backups and snapshots. Manage encryption keys through a dedicated KMS or HSM, using customer-managed keys (CMKs) rather than provider-default keys where the platform offers that option (e.g., AWS EFS, DynamoDB). On mobile, use the platform's secure storage (iOS Keychain, Android Keystore) instead of local/shared storage. - Encoding (e.g., Base64, hex) is not encryption and provides no confidentiality; do not rely on it as a substitute. - Apply masking or tokenization to sensitive fields (e.g., payment card data) where required by applicable standards such as PCI DSS. - If the exposure is caused by credentials or secrets hardcoded in source code rather than data at rest, encryption in place is not sufficient: remove the credentials from the codebase, rotate them immediately, purge them from git history, and load them from a secrets manager or environment variables.
Threat
Anonymous attacker with access to the system's storage, network traffic, or cloud resources.
Expected Remediation Time
⏱️ 90 minutes.
Details
Why
When secret credentials are compromised, we always generate a vulnerability report either the credentials are mocks, or are functional only in specific scenarios such as local environments. The risk of this scenario is usually considered in the severity tab. For local environment credentials the risk is low but not zero.
Hence to solve this vulnerability we recommend to remove the credentials from the source code, change the compromised credentials and ideally remove the credentials from the git log. In some cases the last recommendation cannot be applied to avoid traceability issues. If that's the case, in addition to removing the credentials from the code, we require a customer confirmation that the credentials were changed to close the vulnerability.
Requirements
134 - Store passwords with salt135 - Passwords with random salt185 - Encrypt sensitive information229 - Request access credentials264 - Request authentication300 - Mask sensitive data305 - Prioritize token usageRules
Aws Redshift Encryption DisabledAws Volume Encryption DisabledAws Unencrypted StorageAws Ebs Encryption DisabledAws S3 Server Side Encryption DisabledAws Encryption DisabledHttp Sensitive Fields In Response BodyPhp User Input Storage Sensitive DataJson Yaml Redshift Encryption DisabledRuby Hardcoded Session Secret TokenTypescript Hardcoded Private KeyElixir Ecto Plaintext Storage Of PasswordRust Diesel Plaintext Storage Of PasswordTerraform Encryption Disabled Or MissingDart Insecure Storage Of Sensitive DataTerraform Unencrypted Ebs Block DeviceScala Hardcoded Key In SecretkeyspecDart Hardcoded Cryptography KeyScala Hardcoded Keyparameter UseRuby Hardcoded Key For TokenPython Hardcoded Aws CredentialsGo Gorm Plaintext Storage Of PasswordGo Sql Plaintext Storage Of PasswordTerraform Server Side Encryption DisabledJson Yaml Server Side Encryption DisabledTypescript Insecure Sensitive Information File StorageTypescript Hardcoded Hmac KeyJson Yaml Ebs Encryption Disabled Launch ConfigDart Get Storage Insecure Data StorageTypescript Weak Password Encoding Base64Rust Diesel Weak Password Encoding Base64Elixir Ecto Weak Password Encoding Base64Dart Clipboard Sensitive DataSwift Sensitive Information CompromisedJavascript Hardcoded Private KeyJava Hardcoded Keyparameter UseJavascript Weak Password Encoding Base64Javascript Hardcoded Hmac KeySwift Sensitive Data In External StorageRuby Hardcoded Encryption KeySwift Local Sensitive InformationSwift Insecure Data No File ProtectionJson Yaml Unencrypted Efs FilesystemC Sharp Hardcoded Connection PasswordJson Yaml Storage Encrypted FalseJavascript Insecure Sensitive Information File StorageJava Null Cipher UsedConfig Files Plaintext Certificate StorageSwift Cloud Information CompromisedScala Spring Plaintext Storage Sensitive DataScala Play Plaintext Storage Sensitive DataTerraform Storage Encrypted FalseC Sharp Insecure Cookie Data StorageDart File Storage Of Sensitive DataC Sharp Hardcoded Cryptographic KeyTerraform Unencrypted Efs Filesystem