Hard-coded secrets refer to the practice of embedding sensitive information,such as passwords, encryption keys, or API keys, directly in the source codeof an application.
This practice can make it easy for attackers to identify and exploit these secrets,leading to security vulnerabilities and other types of security threats.
Hard-coded secrets are a security risk because they are often stored in plain text,making it easy for attackers to extract them from the source code.They can also be inadvertently disclosed or exposed through other security vulnerabilities,such as code injection or data leaks.
Hard-coded secrets can affect various types of applications, such as web applications,mobile applications, and desktop applications. They can also be found in infrastructure components,such as scripts, configuration files, and server software.
At GuardRails, we differentiate between different kinds of secrets and cover the below CWEs.
Hard-coded Credentials (CWE-798)
Hard-coded Passwords (CWE-259)
Hard-coded Cryptographic Key (CWE-321)
What is the impact of Hard-Coded Secrets?
Hard-coded secrets can lead to various security threats and risks, such as:
- Information disclosure: Hard-coded secrets can expose sensitive information, such as passwords, keys, or other types of confidential information, to unauthorized parties.
- Unauthorized access: Hard-coded secrets can allow attackers to gain unauthorized access to applications, systems, or networks, perform unauthorized actions, or modify data.
- Data modification: Hard-coded secrets can allow attackers to modify data or system configurations, leading to data loss or corruption, or other types of system instability.
This has led to many high-profile breaches.
To prevent hard-coded secrets, implement appropriate security measures, such as:
- Use environment variables: Use environment variables or configuration files to store sensitive information, such as passwords or keys, instead of hard-coding them in the source code.
- Use secure storage: Store sensitive information in secure storage, such as a secure key vault, that provides additional security features, such as access controls and encryption.
- Use encryption: Use encryption to protect sensitive information in transit and at rest, such as using TLS for network traffic and encrypting storage media.
- Apply access controls: Apply access controls to limit the privileges and actions that users or applications can perform on sensitive information, such as using role-based access controls or fine-grained access controls.
- Use secure coding practices: Follow secure coding practices, such as code reviews, vulnerability scanning and testing, and threat modeling, to ensure that the source code is free of vulnerabilities and that sensitive information is properly protected.
A list of popular secure key vault software can be found below:
References
Taxonomies
- OWASP Top 10 - A02 Cryptographic Failures
- OWASP Top 10 - A07 Identification and Authentication Failures
- SANS TOP 25 - #15
- CWE-798: Use of Hard-coded Credentials
Explanation & Prevention
- Leaking secrets on GitHub, What to do?
- An Introduction to Managing Secrets Safely with Version Control Systems
- Removing Sensitive Data from a Repository
- BFG Repo Cleaner
- TravisCI - Secure Env in Pull Requests
- CircleCI - Environment Variables
- Jenkins - Injecting Secrets
- 12 Factor App - Config
- Vault Guides
- How to securely store API-Keys
- The best way to store secrets in your app
- Holistic Info-Sec for Web Developers - Storage of Secrets risks
- Holistic Info-Sec for Web Developers - Storage of Secrets countermeasures
