Create rule S7154: Fastly API tokens should not be disclosed (#4489)

* Create rule S7154 * Add text * Apply suggestions from code review Co-authored-by: Pierre-Loup <49131563+pierre-loup-tristant-sonarsource@users.noreply.github.com> --------- Co-authored-by: loris-s-sonarsource <[email protected]> Co-authored-by: Loris Sierra <[email protected]> Co-authored-by: Loris S. <[email protected]> Co-authored-by: Pierre-Loup <49131563+pierre-loup-tristant-sonarsource@users.noreply.github.com>
SonarSource · Dec 17, 2024 · 77c4627 · 77c4627
1 parent 5e5c005
commit 77c4627
Show file tree

Hide file tree

Showing 3 changed files with 110 additions and 0 deletions.
diff --git a/rules/S7154/metadata.json b/rules/S7154/metadata.json
@@ -0,0 +1,2 @@
+{
+}
diff --git a/rules/S7154/secrets/metadata.json b/rules/S7154/secrets/metadata.json
@@ -0,0 +1,56 @@
+{
+  "title": "Fastly API tokens should not be disclosed",
+  "type": "VULNERABILITY",
+  "code": {
+    "impacts": {
+      "SECURITY": "HIGH"
+    },
+    "attribute": "TRUSTWORTHY"
+  },
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "30min"
+  },
+  "tags": [
+    "cwe",
+    "cert"
+  ],
+  "defaultSeverity": "Blocker",
+  "ruleSpecification": "RSPEC-7154",
+  "sqKey": "S7154",
+  "scope": "All",
+  "securityStandards": {
+    "CWE": [
+      798,
+      259
+    ],
+    "OWASP": [
+      "A3"
+    ],
+    "CERT": [
+      "MSC03-J."
+    ],
+    "OWASP Top 10 2021": [
+      "A7"
+    ],
+    "PCI DSS 3.2": [
+      "6.5.10"
+    ],
+    "PCI DSS 4.0": [
+      "6.2.4"
+    ],
+    "ASVS 4.0": [
+      "2.10.4",
+      "3.5.2",
+      "6.4.1"
+    ],
+    "STIG ASD_V5R3": [
+      "V-222642"
+    ]
+  },
+  "defaultQualityProfiles": [
+    "Sonar way"
+  ],
+  "quickfix": "unknown"
+}
diff --git a/rules/S7154/secrets/rule.adoc b/rules/S7154/secrets/rule.adoc
@@ -0,0 +1,52 @@
+
+include::../../../shared_content/secrets/description.adoc[]
+
+== Why is this an issue?
+
+include::../../../shared_content/secrets/rationale.adoc[]
+
+=== What is the potential impact?
+
+API tokens get access to the Fastly API. Tokens can be granted restricted
+permissions that limit access to Fastly services and resources, such as
+
+* Load Balancers
+* Web Application Firewalls (WAF)
+* TLS configuration
+* Access Control Lists (ACL)
+* etc.
+
+Below are some real-world scenarios that illustrate some impacts of an attacker
+exploiting the secret.
+
+:secret_type: API token
+:service_name: network
+
+include::../../../shared_content/secrets/impact/data_compromise.adoc[]
+
+include::../../../shared_content/secrets/impact/exceed_rate_limits.adoc[]
+
+include::../../../shared_content/secrets/impact/infrastructure_takeover.adoc[]
+
+include::../../../shared_content/secrets/impact/malware_distribution.adoc[]
+
+== How to fix it
+
+include::../../../shared_content/secrets/fix/revoke.adoc[]
+
+include::../../../shared_content/secrets/fix/recent_use.adoc[]
+
+include::../../../shared_content/secrets/fix/vault.adoc[]
+
+=== Code examples
+
+:example_secret: 6_v7LZNu9kfidP8MtryE_-X_A9wqGrIx
+:example_name: fastly-token
+:example_env: FASTLY_TOKEN
+
+include::../../../shared_content/secrets/examples.adoc[]
+
+== Resources
+
+include::../../../shared_content/secrets/resources/standards.adoc[]
+