Skip to main content

Non-encrypted confidential information - DB

Description​

The application stores information from user queries within the database that is stored on the device, allowing an attacker to access the information.

Impact​

Obtain information from user queries.

Recommendation​

Encrypt all sensitive information that is transported or stored within the application according to the organizations policies.

Threat​

Unauthenticated attacker with access to the device.

Expected Remediation Time​

⌚ 30 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: L
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 4.0
    • Temporal: 4.0
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

All sensitive resources are correctly configured without storing their credentials in the source code

resource "aws_db_instance" "default" {
  allocated_storage       = 10
  storage_encrypted       = true
  engine                  = "mysql"
  engine_version          = "5.7"
  instance_class          = "db.t3.micro"
  name                    = "mydb"
  username                = "foo"
  deletion_protection     = true
  password                = "foobarbaz"
  backup_retention_period = 2
  parameter_group_name    = "default.mysql5.7"
  skip_final_snapshot     = true
}

All resource should have storage encryption enabled

RDSDBInstance1:
  Properties:
    AvailabilityZone:
      Fn::GetAtt:
        - Subnet1
        - AvailabilityZone
    DBClusterIdentifier:
      Ref: RDSCluster
    DBInstanceClass: db.r3.xlarge
    DBParameterGroupName:
      Ref: RDSDBParameterGroup
    DBSubnetGroupName:
      Ref: DBSubnetGroup
    Engine: aurora
    PubliclyAccessible: "true"
    StorageEncrypted: true
  Type: "AWS::RDS::DBInstance"

Non compliant code​

A resource is insecurely configured with the credentials stored in the code

resource "aws_db_instance" "default" {
  allocated_storage       = 10
  storage_encrypted       = false
  engine                  = "mysql"
  engine_version          = "5.7"
  instance_class          = "db.t3.micro"
  name                    = "mydb"
  username                = "foo"
  deletion_protection     = true
  password                = "foobarbaz"
  backup_retention_period = 2
  parameter_group_name    = "default.mysql5.7"
  skip_final_snapshot     = true
}

A resource that does not have its storage encrypted

RDSCluster2:
  Properties:
    DBClusterParameterGroupName:
      Ref: RDSDBClusterParameterGroup
    DBSubnetGroupName:
      Ref: DBSubnetGroup
    Engine: aurora
    MasterUserPassword:
      Ref: password
    MasterUsername:
      Ref: username
    StorageEncrypted: false
  Type: "AWS::RDS::DBCluster"

Using the AWS CLI, the following command checks if the RDS enables encryption for the information

$ aws rds describe-db-instances
      --region us-east-1
      --db-instance-identifier prod-mysql-db
      --query 'DBInstances[*].StorageEncrypted'

If the command output returns false, data encryption is not enabled on the RDS.

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.