From 2372e9c36ad2fe06cf91878725b2e6c6cdb0c5c3 Mon Sep 17 00:00:00 2001 From: loris-s-sonarsource Date: Wed, 13 Nov 2024 11:38:52 +0000 Subject: [PATCH 1/3] Create rule S7161 --- rules/S7161/metadata.json | 2 ++ rules/S7161/secrets/metadata.json | 56 +++++++++++++++++++++++++++++++ rules/S7161/secrets/rule.adoc | 50 +++++++++++++++++++++++++++ 3 files changed, 108 insertions(+) create mode 100644 rules/S7161/metadata.json create mode 100644 rules/S7161/secrets/metadata.json create mode 100644 rules/S7161/secrets/rule.adoc diff --git a/rules/S7161/metadata.json b/rules/S7161/metadata.json new file mode 100644 index 00000000000..2c63c085104 --- /dev/null +++ b/rules/S7161/metadata.json @@ -0,0 +1,2 @@ +{ +} diff --git a/rules/S7161/secrets/metadata.json b/rules/S7161/secrets/metadata.json new file mode 100644 index 00000000000..01d876a0109 --- /dev/null +++ b/rules/S7161/secrets/metadata.json @@ -0,0 +1,56 @@ +{ + "title": "SECRET_TYPE should not be disclosed", + "type": "VULNERABILITY", + "code": { + "impacts": { + "SECURITY": "HIGH" + }, + "attribute": "TRUSTWORTHY" + }, + "status": "ready", + "remediation": { + "func": "Constant\/Issue", + "constantCost": "30min" + }, + "tags": [ + "cwe", + "cert" + ], + "defaultSeverity": "Blocker", + "ruleSpecification": "RSPEC-7161", + "sqKey": "S7161", + "scope": "All", + "securityStandards": { + "CWE": [ + 798, + 259 + ], + "OWASP": [ + "A3" + ], + "CERT": [ + "MSC03-J." + ], + "OWASP Top 10 2021": [ + "A7" + ], + "PCI DSS 3.2": [ + "6.5.10" + ], + "PCI DSS 4.0": [ + "6.2.4" + ], + "ASVS 4.0": [ + "2.10.4", + "3.5.2", + "6.4.1" + ], + "STIG ASD_V5R3": [ + "V-222642" + ] + }, + "defaultQualityProfiles": [ + "Sonar way" + ], + "quickfix": "unknown" +} diff --git a/rules/S7161/secrets/rule.adoc b/rules/S7161/secrets/rule.adoc new file mode 100644 index 00000000000..28f3a64def8 --- /dev/null +++ b/rules/S7161/secrets/rule.adoc @@ -0,0 +1,50 @@ + +include::../../../shared_content/secrets/description.adoc[] + +== Why is this an issue? + +include::../../../shared_content/secrets/rationale.adoc[] + +=== What is the potential impact? + +// Optional: Give a general description of the secret and what it's used for. + +Below are some real-world scenarios that illustrate some impacts of an attacker +exploiting the secret. + +// Set value that can be used to refer to the type of secret in, for example: +// "An attacker can use this {secret_type} to ..." +:secret_type: secret + +// Where possible, use predefined content for common impacts. This content can +// be found in the folder "shared_content/secrets/impact". +// When using predefined content, search for any required variables to be set and include them in this file. +// Not adding them will not trigger warnings. + +//include::../../../shared_content/secrets/impact/some_impact.adoc[] + +== How to fix it + +include::../../../shared_content/secrets/fix/revoke.adoc[] + +include::../../../shared_content/secrets/fix/vault.adoc[] + +=== Code examples + +:example_secret: example_secret_value +:example_name: java-property-name +:example_env: ENV_VAR_NAME + +include::../../../shared_content/secrets/examples.adoc[] + +//=== How does this work? + +//=== Pitfalls + +//=== Going the extra mile + +== Resources + +include::../../../shared_content/secrets/resources/standards.adoc[] + +//=== Benchmarks From bbaf63fd3ed15967ac064ce4eeeb0f2cc5c4a866 Mon Sep 17 00:00:00 2001 From: Loris Sierra Date: Thu, 14 Nov 2024 16:07:35 +0100 Subject: [PATCH 2/3] Add text --- rules/S6762/secrets/rule.adoc | 8 ++--- rules/S7161/secrets/metadata.json | 2 +- rules/S7161/secrets/rule.adoc | 32 ++++++++----------- .../secrets/impact/dataviz_takeover.adoc | 12 +++++++ 4 files changed, 30 insertions(+), 24 deletions(-) create mode 100644 shared_content/secrets/impact/dataviz_takeover.adoc diff --git a/rules/S6762/secrets/rule.adoc b/rules/S6762/secrets/rule.adoc index eace6babd21..f19db1d306e 100644 --- a/rules/S6762/secrets/rule.adoc +++ b/rules/S6762/secrets/rule.adoc @@ -10,13 +10,11 @@ If an attacker gains access to a Grafana personal access token or Granafa Cloud Depending on the permissions given to the secret, the impact might range from the compromise of the data of some dashboards to a full takeover of the Grafana environment. -include::../../../shared_content/secrets/impact/data_compromise.adoc[] - -==== Application takeover +:service_name: Grafana -With control over the Grafana application, the attacker can modify dashboards, alter data sources, or inject malicious code. This can result in the manipulation of displayed data, misleading visualizations, or even the introduction of backdoors for further exploitation. +include::../../../shared_content/secrets/impact/data_compromise.adoc[] -The attacker may even attempt to escalate their privileges within the Grafana environment. By gaining administrative access or higher-level permissions, they can perform more significant actions, such as modifying access controls, adding or deleting users, or changing system configurations. +include::../../../shared_content/secrets/impact/dataviz_takeover.adoc[] == How to fix it diff --git a/rules/S7161/secrets/metadata.json b/rules/S7161/secrets/metadata.json index 01d876a0109..3b6e609727c 100644 --- a/rules/S7161/secrets/metadata.json +++ b/rules/S7161/secrets/metadata.json @@ -1,5 +1,5 @@ { - "title": "SECRET_TYPE should not be disclosed", + "title": "Tableau secrets should not be disclosed", "type": "VULNERABILITY", "code": { "impacts": { diff --git a/rules/S7161/secrets/rule.adoc b/rules/S7161/secrets/rule.adoc index 28f3a64def8..2c7c2bdaccc 100644 --- a/rules/S7161/secrets/rule.adoc +++ b/rules/S7161/secrets/rule.adoc @@ -7,21 +7,24 @@ include::../../../shared_content/secrets/rationale.adoc[] === What is the potential impact? -// Optional: Give a general description of the secret and what it's used for. +Tableau secrets scopes depend on the type of secret. From the most impactful to +the least: + +1. Account passwords +2. Personal access tokens (PAT) +3. "Credentials token", received after a SignIn request + +Their scopes vary in terms of lifetime, access, and impact. Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret. -// Set value that can be used to refer to the type of secret in, for example: -// "An attacker can use this {secret_type} to ..." :secret_type: secret +:service_name: Tableau -// Where possible, use predefined content for common impacts. This content can -// be found in the folder "shared_content/secrets/impact". -// When using predefined content, search for any required variables to be set and include them in this file. -// Not adding them will not trigger warnings. +include::../../../shared_content/secrets/impact/data_compromise.adoc[] -//include::../../../shared_content/secrets/impact/some_impact.adoc[] +include::../../../shared_content/secrets/impact/dataviz_takeover.adoc[] == How to fix it @@ -31,20 +34,13 @@ include::../../../shared_content/secrets/fix/vault.adoc[] === Code examples -:example_secret: example_secret_value -:example_name: java-property-name -:example_env: ENV_VAR_NAME +:example_secret: FMWBZfscS96flnAPXVY06w|QQsOzThG6hqNvZcd6OPIpZs88lgcYTcb|77bfee95-c689-4fd1-a7e0-2cf050adbbb2 +:example_name: tableau-auth +:example_env: TABLEAU_AUTH include::../../../shared_content/secrets/examples.adoc[] -//=== How does this work? - -//=== Pitfalls - -//=== Going the extra mile - == Resources include::../../../shared_content/secrets/resources/standards.adoc[] -//=== Benchmarks diff --git a/shared_content/secrets/impact/dataviz_takeover.adoc b/shared_content/secrets/impact/dataviz_takeover.adoc new file mode 100644 index 00000000000..6bd9ad31083 --- /dev/null +++ b/shared_content/secrets/impact/dataviz_takeover.adoc @@ -0,0 +1,12 @@ +==== Dataviz Corruption and Takeover + +With control over the {service_name} application, the attacker can modify +dashboards, alter data sources, or inject malicious code. This can result in the +manipulation of displayed data, misleading visualizations, or even the +introduction of backdoors for further exploitation. + +The attacker may even attempt to escalate their privileges within the +{service_name} environment. By gaining administrative access or higher-level +permissions, they can perform more significant actions, such as modifying access +controls, adding or deleting users, or changing system configurations. + From 466d3ae239b425a571f8c6402d4d069117f6ec7f Mon Sep 17 00:00:00 2001 From: "Loris S." <91723853+loris-s-sonarsource@users.noreply.github.com> Date: Fri, 15 Nov 2024 16:25:34 +0100 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: Jamie Anderson <127742609+jamie-anderson-sonarsource@users.noreply.github.com> --- rules/S7161/secrets/rule.adoc | 2 +- shared_content/secrets/impact/dataviz_takeover.adoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/S7161/secrets/rule.adoc b/rules/S7161/secrets/rule.adoc index 2c7c2bdaccc..f525725c372 100644 --- a/rules/S7161/secrets/rule.adoc +++ b/rules/S7161/secrets/rule.adoc @@ -14,7 +14,7 @@ the least: 2. Personal access tokens (PAT) 3. "Credentials token", received after a SignIn request -Their scopes vary in terms of lifetime, access, and impact. +Their scopes vary in terms of lifetime, access, and privileges. Below are some real-world scenarios that illustrate some impacts of an attacker exploiting the secret. diff --git a/shared_content/secrets/impact/dataviz_takeover.adoc b/shared_content/secrets/impact/dataviz_takeover.adoc index 6bd9ad31083..deb4efcf309 100644 --- a/shared_content/secrets/impact/dataviz_takeover.adoc +++ b/shared_content/secrets/impact/dataviz_takeover.adoc @@ -1,4 +1,4 @@ -==== Dataviz Corruption and Takeover +==== Data visualization corruption and takeover With control over the {service_name} application, the attacker can modify dashboards, alter data sources, or inject malicious code. This can result in the