diff --git a/rules/S7153/metadata.json b/rules/S7153/metadata.json new file mode 100644 index 00000000000..2c63c085104 --- /dev/null +++ b/rules/S7153/metadata.json @@ -0,0 +1,2 @@ +{ +} diff --git a/rules/S7153/secrets/metadata.json b/rules/S7153/secrets/metadata.json new file mode 100644 index 00000000000..2068aa7c7b8 --- /dev/null +++ b/rules/S7153/secrets/metadata.json @@ -0,0 +1,56 @@ +{ + "title": "eBay OAuth credentials should not be disclosed", + "type": "VULNERABILITY", + "code": { + "impacts": { + "SECURITY": "HIGH" + }, + "attribute": "TRUSTWORTHY" + }, + "status": "ready", + "remediation": { + "func": "Constant\/Issue", + "constantCost": "30min" + }, + "tags": [ + "cwe", + "cert" + ], + "defaultSeverity": "Blocker", + "ruleSpecification": "RSPEC-7153", + "sqKey": "S7153", + "scope": "All", + "securityStandards": { + "CWE": [ + 798, + 259 + ], + "OWASP": [ + "A3" + ], + "CERT": [ + "MSC03-J." + ], + "OWASP Top 10 2021": [ + "A7" + ], + "PCI DSS 3.2": [ + "6.5.10" + ], + "PCI DSS 4.0": [ + "6.2.4" + ], + "ASVS 4.0": [ + "2.10.4", + "3.5.2", + "6.4.1" + ], + "STIG ASD_V5R3": [ + "V-222642" + ] + }, + "defaultQualityProfiles": [ + "Sonar way" + ], + "quickfix": "unknown" +} diff --git a/rules/S7153/secrets/rule.adoc b/rules/S7153/secrets/rule.adoc new file mode 100644 index 00000000000..337b320e4ab --- /dev/null +++ b/rules/S7153/secrets/rule.adoc @@ -0,0 +1,44 @@ + +include::../../../shared_content/secrets/description.adoc[] + +== Why is this an issue? + +include::../../../shared_content/secrets/rationale.adoc[] + +=== What is the potential impact? + +If an attacker gains access to a eBay OAuth credentials, they might be able to authenticate as users or applications. + +Below are some real-world scenarios that illustrate some impacts of an attacker +exploiting the secret. + +==== Financial loss + +Financial losses can occur when a secret used to access eBay APIs is disclosed as part of the source code of +client applications. + +As eBay provides APIs that allow user or applications to sell or to buy products, an attacker could use the secret to change price or buy items using the organization's account. + +include::../../../shared_content/secrets/impact/personal_data_compromise.adoc[] + +== How to fix it + +include::../../../shared_content/secrets/fix/revoke.adoc[] + +include::../../../shared_content/secrets/fix/vault.adoc[] + +=== Code examples + +:example_secret: PRD-fe5d9474b718-6817-4a97-a50b-5752 +:example_name: ebay.client-secret +:example_env: EBAY_CLIENT_SECRET + +include::../../../shared_content/secrets/examples.adoc[] + +== Resources + +=== Documentation + +- eBay Developer Program - https://developer.ebay.com/api-docs/static/oauth-credentials.html[Getting your OAuth credentials] + +include::../../../shared_content/secrets/resources/standards.adoc[]