Skip to main content

Guessed weak credentials

Description

The system credentials low complexity considerably reduces the amount of time required to guess them. This allows an attacker to have quicker success when executing a brute force attack.

Impact

Obtain functional credentials for resources or services.

Recommendation

Enforce strong password policy. A password security policy must contain the following attributes:

  • Configure a minimum and maximum length.
  • Do not use word based passwords.
  • Avoid usernames in the passwords.
  • Do not reuse passwords.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

โŒš 15 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: O
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:X
  • Score:
    • Base: 2.7
    • Temporal: 2.6
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

Ensure the credentials configuration of the application is strong enough

Resources:
MySecret1:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: MySecretForAppA
Description: "This secret has a dynamically generated secret password."
GenerateSecretString:
SecretStringTemplate: '{"username": "test-user"}'
GenerateStringKey: "password"
PasswordLength: 16
ExcludeCharacters: '"@/\'
ExcludeLowercase: false
ExcludeNumbers: false
ExcludePunctuation: false
ExcludeUppercase: false
IncludeSpace: false
RequireEachIncludedType: true

Non compliant code

Weak credentials configuration

Resources:
MySecret1:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: MySecretForAppA
Description: "This secret has a dynamically generated secret password."
GenerateSecretString:
SecretStringTemplate: '{"username": "test-user"}'
GenerateStringKey: "password"
PasswordLength: 8
ExcludeLowercase: true
ExcludeNumbers: false
ExcludePunctuation: true
ExcludeUppercase: false
IncludeSpace: true
RequireEachIncludedType: false

Requirements