search

Azure-Samples / azuresandbox

Stand up an Azure sandbox environment for accelerating your projects in an hour.
MIT License
64 stars 30 forks source link

Jumpwin1 Custom Script Extension stores secrets in clear text #32

Closed doherty100 closed 2 months ago

doherty100 commented 2 months ago

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #AzureSandbox v2.9.2 Enable Defender for Cloud CSPM agentless scanning

Any log messages given by the failure

Contains Verified Secret risk factor related to file C:\Packages\Plugins\Microsoft.compute.CustomScriptExtension\1.10.15\RuntimeSettings\0.settings finding on jumpwin1

Expected/desired behavior

Eliminate the local storage of secrets altogether or at a minimum do not store them in clear text

OS and Version?

Windows Server 2022

Versions

AzureSandbox v2.9.2

Mention any other details that might be useful

Secrets are passed as clear text parameters to script configure-vm-jumpbox-win.ps1 using custom script extension.

Thanks! We'll be in touch soon.