Skip to main content

Guessed weak credentials

Description

The system credentials low complexity considerably reduces the amount of time required to guess them. This allows an attacker to have quicker success when executing a brute force attack.

Impact

Obtain functional credentials for resources or services.

Recommendation

Enforce strong password policy. A password security policy must contain the following attributes:

  • Configure a minimum and maximum length.
  • Do not use word based passwords.
  • Avoid usernames in the passwords.
  • Do not reuse passwords.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⌚ 15 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: O
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:X
  • Score:
    • Base: 2.7
    • Temporal: 2.6
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

Ensure the credentials configuration of the application is strong enough

Resources:
  MySecret1:
    Type: 'AWS::SecretsManager::Secret'
    Properties:
      Name: MySecretForAppA
      Description: "This secret has a dynamically generated secret password."
      GenerateSecretString:
        SecretStringTemplate: '{"username": "test-user"}'
        GenerateStringKey: "password"
        PasswordLength: 16
        ExcludeCharacters: '"@/\'
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: false
        ExcludeUppercase: false
        IncludeSpace: false
        RequireEachIncludedType: true

Non compliant code

Weak credentials configuration

Resources:
  MySecret1:
    Type: 'AWS::SecretsManager::Secret'
    Properties:
      Name: MySecretForAppA
      Description: "This secret has a dynamically generated secret password."
      GenerateSecretString:
        SecretStringTemplate: '{"username": "test-user"}'
        GenerateStringKey: "password"
        PasswordLength: 8
        ExcludeLowercase: true
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        IncludeSpace: true
        RequireEachIncludedType: false

Requirements