From 00751ec5e7f52ac767c6680ee16afa15106c2e18 Mon Sep 17 00:00:00 2001 From: sebastien-andrivet-sonarsource Date: Tue, 12 Nov 2024 11:00:40 +0000 Subject: [PATCH 1/5] Create rule S7155 --- rules/S7155/metadata.json | 2 ++ rules/S7155/secrets/metadata.json | 56 +++++++++++++++++++++++++++++++ rules/S7155/secrets/rule.adoc | 50 +++++++++++++++++++++++++++ 3 files changed, 108 insertions(+) create mode 100644 rules/S7155/metadata.json create mode 100644 rules/S7155/secrets/metadata.json create mode 100644 rules/S7155/secrets/rule.adoc diff --git a/rules/S7155/metadata.json b/rules/S7155/metadata.json new file mode 100644 index 00000000000..2c63c085104 --- /dev/null +++ b/rules/S7155/metadata.json @@ -0,0 +1,2 @@ +{ +} diff --git a/rules/S7155/secrets/metadata.json b/rules/S7155/secrets/metadata.json new file mode 100644 index 00000000000..e7514f4d502 --- /dev/null +++ b/rules/S7155/secrets/metadata.json @@ -0,0 +1,56 @@ +{ + "title": "SECRET_TYPE should not be disclosed", + "type": "VULNERABILITY", + "code": { + "impacts": { + "SECURITY": "HIGH" + }, + "attribute": "TRUSTWORTHY" + }, + "status": "ready", + "remediation": { + "func": "Constant\/Issue", + "constantCost": "30min" + }, + "tags": [ + "cwe", + "cert" + ], + "defaultSeverity": "Blocker", + "ruleSpecification": "RSPEC-7155", + "sqKey": "S7155", + "scope": "All", + "securityStandards": { + "CWE": [ + 798, + 259 + ], + "OWASP": [ + "A3" + ], + "CERT": [ + "MSC03-J." + ], + "OWASP Top 10 2021": [ + "A7" + ], + "PCI DSS 3.2": [ + "6.5.10" + ], + "PCI DSS 4.0": [ + "6.2.4" + ], + "ASVS 4.0": [ + "2.10.4", + "3.5.2", + "6.4.1" + ], + "STIG ASD_V5R3": [ + "V-222642" + ] + }, + "defaultQualityProfiles": [ + "Sonar way" + ], + "quickfix": "unknown" +} diff --git a/rules/S7155/secrets/rule.adoc b/rules/S7155/secrets/rule.adoc new file mode 100644 index 00000000000..28f3a64def8 --- /dev/null +++ b/rules/S7155/secrets/rule.adoc @@ -0,0 +1,50 @@ + +include::../../../shared_content/secrets/description.adoc[] + +== Why is this an issue? + +include::../../../shared_content/secrets/rationale.adoc[] + +=== What is the potential impact? + +// Optional: Give a general description of the secret and what it's used for. + +Below are some real-world scenarios that illustrate some impacts of an attacker +exploiting the secret. + +// Set value that can be used to refer to the type of secret in, for example: +// "An attacker can use this {secret_type} to ..." +:secret_type: secret + +// Where possible, use predefined content for common impacts. This content can +// be found in the folder "shared_content/secrets/impact". +// When using predefined content, search for any required variables to be set and include them in this file. +// Not adding them will not trigger warnings. + +//include::../../../shared_content/secrets/impact/some_impact.adoc[] + +== How to fix it + +include::../../../shared_content/secrets/fix/revoke.adoc[] + +include::../../../shared_content/secrets/fix/vault.adoc[] + +=== Code examples + +:example_secret: example_secret_value +:example_name: java-property-name +:example_env: ENV_VAR_NAME + +include::../../../shared_content/secrets/examples.adoc[] + +//=== How does this work? + +//=== Pitfalls + +//=== Going the extra mile + +== Resources + +include::../../../shared_content/secrets/resources/standards.adoc[] + +//=== Benchmarks From d3dd2c1abf5f37d9cd2fa8dc33734a9e0d354e25 Mon Sep 17 00:00:00 2001 From: Sebastien Andrivet Date: Tue, 12 Nov 2024 15:41:59 +0100 Subject: [PATCH 2/5] Update rule --- rules/S7155/secrets/metadata.json | 2 +- rules/S7155/secrets/rule.adoc | 27 ++++++++++++++------------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/rules/S7155/secrets/metadata.json b/rules/S7155/secrets/metadata.json index e7514f4d502..63343e9da91 100644 --- a/rules/S7155/secrets/metadata.json +++ b/rules/S7155/secrets/metadata.json @@ -1,5 +1,5 @@ { - "title": "SECRET_TYPE should not be disclosed", + "title": "CircleCI secrets should not be disclosed", "type": "VULNERABILITY", "code": { "impacts": { diff --git a/rules/S7155/secrets/rule.adoc b/rules/S7155/secrets/rule.adoc index 28f3a64def8..27531225fc5 100644 --- a/rules/S7155/secrets/rule.adoc +++ b/rules/S7155/secrets/rule.adoc @@ -1,27 +1,22 @@ include::../../../shared_content/secrets/description.adoc[] +If attackers gains access to a CircleCI API key, they might be able to modify projects and jobs running on the CircleCi platform. + == Why is this an issue? include::../../../shared_content/secrets/rationale.adoc[] === What is the potential impact? -// Optional: Give a general description of the secret and what it's used for. +The exact impact of the compromise of an CircleCI API key varies depending on the permissions granted to this token and of its type (personal or project token). It can range from loss of sensitive data and source code to severe supply chain attacks. Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret. -// Set value that can be used to refer to the type of secret in, for example: -// "An attacker can use this {secret_type} to ..." -:secret_type: secret - -// Where possible, use predefined content for common impacts. This content can -// be found in the folder "shared_content/secrets/impact". -// When using predefined content, search for any required variables to be set and include them in this file. -// Not adding them will not trigger warnings. +include::../../../shared_content/secrets/impact/source_code_compromise.adoc[] -//include::../../../shared_content/secrets/impact/some_impact.adoc[] +include::../../../shared_content/secrets/impact/supply_chain_attack.adoc[] == How to fix it @@ -31,9 +26,9 @@ include::../../../shared_content/secrets/fix/vault.adoc[] === Code examples -:example_secret: example_secret_value -:example_name: java-property-name -:example_env: ENV_VAR_NAME +:example_secret: CCIPAT_FERZRjTN451xnDCy1y9gWn_79fb6ca4d0e5f833612eee17de397a9dca0a9e9f +:example_name: cci-api-key +:example_env: CCI_API_KEY include::../../../shared_content/secrets/examples.adoc[] @@ -43,8 +38,14 @@ include::../../../shared_content/secrets/examples.adoc[] //=== Going the extra mile +include::../../../shared_content/secrets/extra_mile/permissions_scope.adoc[] + == Resources +=== Documentation + +* circleci Docs - https://circleci.com/docs/managing-api-tokens/[Managing API Tokens] + include::../../../shared_content/secrets/resources/standards.adoc[] //=== Benchmarks From d7934ae484b0b8bf6839f8e25f21d4e7f0a1dfef Mon Sep 17 00:00:00 2001 From: Sebastien Andrivet Date: Tue, 12 Nov 2024 16:37:57 +0100 Subject: [PATCH 3/5] Typo + add doc --- rules/S7155/secrets/rule.adoc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/S7155/secrets/rule.adoc b/rules/S7155/secrets/rule.adoc index 27531225fc5..68048654a80 100644 --- a/rules/S7155/secrets/rule.adoc +++ b/rules/S7155/secrets/rule.adoc @@ -1,7 +1,7 @@ include::../../../shared_content/secrets/description.adoc[] -If attackers gains access to a CircleCI API key, they might be able to modify projects and jobs running on the CircleCi platform. +If attackers gains access to a CircleCI API key, they might be able to modify projects and jobs running on the CircleCI platform. == Why is this an issue? @@ -44,7 +44,8 @@ include::../../../shared_content/secrets/extra_mile/permissions_scope.adoc[] === Documentation -* circleci Docs - https://circleci.com/docs/managing-api-tokens/[Managing API Tokens] +* CircleCI Docs - https://circleci.com/docs/managing-api-tokens/[Managing API Tokens] +* CircleCI Docs - https://circleci.com/docs/api-developers-guide/[CircleCI API developer’s guide] include::../../../shared_content/secrets/resources/standards.adoc[] From 32a651aa7d632eac6d85dde4cfbd6dd58bff2651 Mon Sep 17 00:00:00 2001 From: Sebastien Andrivet Date: Wed, 13 Nov 2024 17:22:15 +0100 Subject: [PATCH 4/5] Apply changes following review --- rules/S7155/secrets/metadata.json | 2 +- rules/S7155/secrets/rule.adoc | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/rules/S7155/secrets/metadata.json b/rules/S7155/secrets/metadata.json index 63343e9da91..903c4c89bab 100644 --- a/rules/S7155/secrets/metadata.json +++ b/rules/S7155/secrets/metadata.json @@ -1,5 +1,5 @@ { - "title": "CircleCI secrets should not be disclosed", + "title": "CircleCI API tokens should not be disclosed", "type": "VULNERABILITY", "code": { "impacts": { diff --git a/rules/S7155/secrets/rule.adoc b/rules/S7155/secrets/rule.adoc index 68048654a80..c84afaf7f48 100644 --- a/rules/S7155/secrets/rule.adoc +++ b/rules/S7155/secrets/rule.adoc @@ -1,7 +1,7 @@ include::../../../shared_content/secrets/description.adoc[] -If attackers gains access to a CircleCI API key, they might be able to modify projects and jobs running on the CircleCI platform. +If attackers gain access to a CircleCI API token, they might be able to modify projects and jobs running on the CircleCI platform. == Why is this an issue? @@ -9,7 +9,7 @@ include::../../../shared_content/secrets/rationale.adoc[] === What is the potential impact? -The exact impact of the compromise of an CircleCI API key varies depending on the permissions granted to this token and of its type (personal or project token). It can range from loss of sensitive data and source code to severe supply chain attacks. +The exact impact of compromising a CircleCI API token varies depending on the permissions granted and its type (personal or project token). It can range from loss of sensitive data and source code to severe supply chain attacks. Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret. @@ -27,8 +27,8 @@ include::../../../shared_content/secrets/fix/vault.adoc[] === Code examples :example_secret: CCIPAT_FERZRjTN451xnDCy1y9gWn_79fb6ca4d0e5f833612eee17de397a9dca0a9e9f -:example_name: cci-api-key -:example_env: CCI_API_KEY +:example_name: cci-api-token +:example_env: CCI_API_TOKEN include::../../../shared_content/secrets/examples.adoc[] From 317c8753f3bf5e63ecb6e16264fe6c0250917523 Mon Sep 17 00:00:00 2001 From: Sebastien Andrivet Date: Wed, 13 Nov 2024 17:28:43 +0100 Subject: [PATCH 5/5] Uncomment section --- rules/S7155/secrets/rule.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/S7155/secrets/rule.adoc b/rules/S7155/secrets/rule.adoc index c84afaf7f48..7d513d8b1b0 100644 --- a/rules/S7155/secrets/rule.adoc +++ b/rules/S7155/secrets/rule.adoc @@ -36,7 +36,7 @@ include::../../../shared_content/secrets/examples.adoc[] //=== Pitfalls -//=== Going the extra mile +=== Going the extra mile include::../../../shared_content/secrets/extra_mile/permissions_scope.adoc[]