CVE Vulnerabilities

CVE-2021-21979

Use of Hard-coded Credentials

Published: Mar 03, 2021 | Modified: May 03, 2022
CVSS 3.x
7.3
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your applications encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.

Weakness

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Affected Software

Name Vendor Start Version End Version
Containers Bitnami 8.5.4-debian-10-r1 8.5.4-debian-10-r1
Containers Bitnami 8.5.2-debian-10-r1 8.5.2-debian-10-r1
Containers Bitnami 6.4.0-debian-9-r0 6.4.0-debian-9-r31
Containers Bitnami 6.5.2-debian-9-r0 6.5.2-debian-9-r20
Containers Bitnami 6.8.0-debian-9-r0 6.8.0-debian-9-r26
Containers Bitnami 6.12.0-debian-9-r0 6.12.0-debian-10-r33
Containers Bitnami 6.18.0-debian-10-r0 6.18.0-debian-10-r21
Containers Bitnami 6.18.3-debian-10-r0 6.18.3-debian-10-r22
Containers Bitnami 6.18.8-debian-10-r0 6.18.8-debian-10-r110
Containers Bitnami 6.18.35-debian-10-r0 6.18.35-debian-10-r66
Containers Bitnami 6.19.0-debian-10-r0 6.19.0-debian-10-r0
Containers Bitnami 6.20.0-debian-10-r0 *
Containers Bitnami 7.0.0-debian-10-r0 7.0.0-debian-10-r7
Containers Bitnami 7.3.0-debian-10-r0 7.3.0-debian-10-r20
Containers Bitnami 7.6.0-debian-10-r0 7.6.0-debian-10-r38
Containers Bitnami 7.12.0-debian-10-r0 7.12.0-debian-10-r72
Containers Bitnami 7.25.0-debian-10-r0 7.25.0-debian-10-r16
Containers Bitnami 7.28.0-debian-10-r0 7.28.0-debian-10-r50
Containers Bitnami 7.29.0-debian-10-r0 7.29.0-debian-10-r0
Containers Bitnami 7.30.0-debian-10-r0 7.30.0-debian-10-r0
Containers Bitnami 7.30.1-debian-10-r0 *
Containers Bitnami 8.0.1-debian-10-r0 8.0.1-debian-10-r7
Containers Bitnami 8.0.3-debian-10-r0 8.0.3-debian-10-r18
Containers Bitnami 8.1.0-debian-10-r0 8.1.0-debian-10-r7
Containers Bitnami 8.2.0-debian-10-r0 8.2.0-debian-10-r8
Containers Bitnami 8.3.0-debian-10-r0 8.3.0-debian-10-r0
Containers Bitnami 8.4.0-debian-10-r0 8.4.0-debian-10-r10
Containers Bitnami 8.4.1-debian-10-r0 8.4.1-debian-10-r6
Containers Bitnami 8.4.2-debian-10-r0 8.4.2-debian-10-r4
Containers Bitnami 8.4.3-debian-10-r0 8.4.3-debian-10-r6
Containers Bitnami 8.4.4-debian-10-r0 8.4.4-debian-10-r6
Containers Bitnami 8.5.2-debian-10-r0 8.5.2-debian-10-r0
Containers Bitnami 8.5.3-debian-10-r0 8.5.3-debian-10-r0
Containers Bitnami 8.5.4-debian-10-r0 8.5.4-debian-10-r0
Containers Bitnami 8.5.5-debian-10-r0 8.5.5-debian-10-r11
Containers Bitnami 8.5.6-debian-10-r0 8.5.6-debian-10-r13
Containers Bitnami 8.5.7-debian-10-r0 8.5.7-debian-10-r6
Containers Bitnami 8.5.8-debian-10-r0 8.5.8-debian-10-r5
Containers Bitnami 8.5.9-debian-10-r0 8.5.9-debian-10-r25
Containers Bitnami 8.5.10-debian-10-r0 8.5.10-debian-10-r6
Containers Bitnami 6.0.2-debian-9-r0 6.0.2-debian-9-r22

Extended Description

Hard-coded credentials typically create a significant hole that allows an attacker to bypass the authentication that has been configured by the product administrator. This hole might be difficult for the system administrator to detect. Even if detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely. There are two main variations:

In the Inbound variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. If the password is ever discovered or published (a common occurrence on the Internet), then anybody with knowledge of this password can access the product. Finally, since all installations of the product will have the same password, even across different organizations, this enables massive attacks such as worms to take place. The Outbound variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password which can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product. Any user of that program may be able to extract the password. Client-side systems with hard-coded passwords pose even more of a threat, since the extraction of a password from a binary is usually very simple.

Potential Mitigations

  • For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
  • In Windows environments, the Encrypted File System (EFS) may provide some protection.
  • For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
  • Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
  • For front-end to back-end connections: Three solutions are possible, although none are complete.

References