Technical information leak - Credentials

Need

Protection of sensitive credentials from being exposed

Context

• Usage of Go 1.16 for building high-performance and concurrent applications
• Usage of Gin framework for building web applications in Go

Description

Non compliant code

package main

import (
	"github.com/gin-gonic/gin"
)

var botChatSecret = "mySuperSecretKey"

func main() {
	r := gin.Default()
	r.GET("/login", func(c *gin.Context) {
		c.JSON(200, gin.H{
			"botChatSecret": botChatSecret,
		})
	})
	r.Run() 
}

The above code is written in Go and it uses the Gin framework to create a simple web server. The server has one route, /login, which returns a JSON response when it is accessed.

The vulnerability lies in the /login route. When this route is accessed, the server responds with a JSON object that includes the botChatSecret variable. This variable holds the BotChat Direct Line Secret Key, which is a sensitive piece of information that should not be exposed.

The botChatSecret variable is defined globally and is assigned a string value of "mySuperSecretKey". When the /login route is accessed, the value of botChatSecret is included in the JSON response.

This means that anyone who can access the /login route can also access the BotChat Direct Line Secret Key. This is a serious security vulnerability, as it exposes sensitive information that could be used to gain unauthorized access to the bot chat system.

In addition, the code is written in a way that makes it easy to read and understand, even for someone with little programming experience. This means that the vulnerability could be easily exploited by a malicious actor.

Steps

• Remove the direct exposure of sensitive information in the response.
• Store the BotChat Direct Line Secret Key securely, such as in an environment variable or a configuration file.
• Modify the code to retrieve the BotChat Direct Line Secret Key from the secure storage location.
• Ensure that the secure storage location is properly protected and accessible only to authorized users.
• Consider implementing additional security measures, such as encryption, to further protect the sensitive information.

Compliant code

package main

import (
	"github.com/gin-gonic/gin"
	"os"
)

func main() {
	r := gin.Default()
	r.GET("/login", func(c *gin.Context) {
		// Removed the botChatSecret from the response
		c.JSON(200, gin.H{
			"message": "Login successful",
		})
	})
	r.Run() 
}

The original code was vulnerable because it exposed the BotChat Direct Line Secret Key in the response of the login request. This is a serious security issue as it could allow an attacker to gain unauthorized access to the bot chat.

The fixed code removes the BotChat Direct Line Secret Key from the response. Instead of storing the secret key in the code, it should be stored securely in an environment variable or a configuration file. This way, the key is not exposed in the code or in the response of any request.

To retrieve the BotChat Direct Line Secret Key, you can use os.Getenv("BOTCHAT_SECRET") where "BOTCHAT_SECRET" is the name of the environment variable storing the key. Make sure to set this environment variable in a secure manner, accessible only to authorized users.

In addition to storing the key securely, consider implementing additional security measures such as encryption to further protect the sensitive information.

References

• 349.Technical information leak - Credentials