Skip to main content

Non-encrypted confidential information - DB

Description

The application stores information from user queries within the database that is stored on the device, allowing an attacker to access the information.

Impact

Obtain information from user queries.

Recommendation

Encrypt all sensitive information that is transported or stored within the application according to the organizations policies.

Threat

Unauthenticated attacker with access to the device.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: L
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 4.0
    • Temporal: 4.0
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

All sensitive resources are correctly configured without storing their credentials in the source code

resource "aws_db_instance" "default" {
allocated_storage = 10
storage_encrypted = true
engine = "mysql"
engine_version = "5.7"
instance_class = "db.t3.micro"
name = "mydb"
username = "foo"
deletion_protection = true
password = "foobarbaz"
backup_retention_period = 2
parameter_group_name = "default.mysql5.7"
skip_final_snapshot = true
}

All resource should have storage encryption enabled

RDSDBInstance1:
Properties:
AvailabilityZone:
Fn::GetAtt:
- Subnet1
- AvailabilityZone
DBClusterIdentifier:
Ref: RDSCluster
DBInstanceClass: db.r3.xlarge
DBParameterGroupName:
Ref: RDSDBParameterGroup
DBSubnetGroupName:
Ref: DBSubnetGroup
Engine: aurora
PubliclyAccessible: "true"
StorageEncrypted: true
Type: "AWS::RDS::DBInstance"

Non compliant code

A resource is insecurely configured with the credentials stored in the code

resource "aws_db_instance" "default" {
allocated_storage = 10
storage_encrypted = false
engine = "mysql"
engine_version = "5.7"
instance_class = "db.t3.micro"
name = "mydb"
username = "foo"
deletion_protection = true
password = "foobarbaz"
backup_retention_period = 2
parameter_group_name = "default.mysql5.7"
skip_final_snapshot = true
}

A resource that does not have its storage encrypted

RDSCluster2:
Properties:
DBClusterParameterGroupName:
Ref: RDSDBClusterParameterGroup
DBSubnetGroupName:
Ref: DBSubnetGroup
Engine: aurora
MasterUserPassword:
Ref: password
MasterUsername:
Ref: username
StorageEncrypted: false
Type: "AWS::RDS::DBCluster"

Using the AWS CLI, the following command checks if the RDS enables encryption for the information

$ aws rds describe-db-instances
--region us-east-1
--db-instance-identifier prod-mysql-db
--query 'DBInstances[*].StorageEncrypted'

If the command output returns false, data encryption is not enabled on the RDS.

Requirements