Password with hardcoded value is not detected (.yaml file)

[gabriel-cx]

Steps to reproduce

running the command: ./2ms repository --path "<file_to_scan>"
where <file_to_scan> is this file.

Expected result

2ms finds a hardcoded secret at line 8

Actual result

[baruchiro]

I think my bigger concern here is that feature like this is based on heuristics, and can give a lot of False Positives.

For example, the field may be:

password: "YOUR_PASSWORD_HERE"

[gabriel-cx]

I see your point. In KICS, we trigger a vulnerability result on this cases.

I tried gitleaks and the same file have as result: no leaks found.

[baruchiro]

We will support it and the user will be able to disable it.

Need to research about ignoring patterns like password: "${{env_var}}".

[jossef]

can be done as part of #98
suggesting to close

[baruchiro]

Examples:

var userID = $sessionStorage['userID'] ? $sessionStorage[' userID '] : 'HardcodedUserIDinplaintext';
var headers =  { authorization : "Basic " + btoa(unescape(encodeURIComponent(userID + ":" + 'HardcodedPasswordinplaintext'))),…………………};

{
  username: 'HardcodedUsernameinplaintext',
  password: ' HardcodedPasswordinplaintext ',
}

document.getElementById('userName').value = " HardcodedUsernameinplaintext ";
document.getElementById('password').value = " HardcodedPasswordinplaintext ";

M_DB_USER= HardcodedUsernameinplaintext
M_DB_PASSWORD= HardcodedPasswordinplaintext

private static final String CIPHER_KEY = "HardcodedCipherKey in Numeric";

"... \"access-key\": \"AKIAWIPE......\", ..."

(Waiting for gitleaks/gitleaks#1267)

<password>something_here</password>
<element password="something" />

(Waiting for gitleaks/gitleaks#1265)

[baruchiro]

you can run 2MS with adding --regex "password[:>=] *\"?.*[ <\"]" to the CLI command.
It will catch multiple hard-coded passwords fields.
Just as a very quick solution.
Of course, with more example we will be more accurate.

This is the whole config: 😂

regex:
  - password[:>=] *"?.*[ <"]

and they will find these:

results:
  73ca2669271427b1e4b7ee88701166ed49b82233:
  - id: 73ca2669271427b1e4b7ee88701166ed49b82233
    source: project/10k-most-common.txt
    ruleid: custom-regex-1
    startline: 1
    endline: 1
    startcolumn: 3
    endcolumn: 26
    value: password>something_here<
  76dab5351fa6c906c96f80d03868e8a5a143f021:
  - id: 76dab5351fa6c906c96f80d03868e8a5a143f021
    source: project/10k-most-common.txt
    ruleid: custom-regex-1
    startline: 0
    endline: 0
    startcolumn: 1
    endcolumn: 30
    value: 'password: "YOUR_PASSWORD_HERE"'
  b7eee319f6c69bcaccbdf49cf58c3d1da9a019cf:
  - id: b7eee319f6c69bcaccbdf49cf58c3d1da9a019cf
    source: project/10k-most-common.txt
    ruleid: custom-regex-1
    startline: 2
    endline: 2
    startcolumn: 11
    endcolumn: 31
    value: 'password="something" '