Skip to main content

Sensitive information in source code - Dependencies

Description

By reversing the application dependencies, it is found that the private key has been stored in the same dependency and not in a protected environment.

Impact

Obtain the private key used to decrypt the information.

Recommendation

Securely configure the vulnerable service so that it can only be accessed by authorized users.

Threat

Internal attacker with access to the artifactory.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: A
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: H
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 5.7
    • Temporal: 5.7
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

Verify that none of the dependencies imported on the application store sensitive data like private keys

Non compliant code

The code has a dependency imported which stores sensitive credentials

<dependencyManagement>
<dependencies>
<dependency>
<groupId>vulnerableDependency</groupId>
<artifactId>vulnerableId</artifactId>
<version>3.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>

Requirements