Open davinerd opened 5 years ago
Hello,
I was about to open a new issue, but since this seems to be related I will complement with my information.
Question | Answer |
---|---|
OS version (server) | Ubuntu 16.04 |
TheHive version / git hash | 3.2.1-1 |
Package Type | DEB |
In some cases, an error in a Cortex-Analyzer code can reveal the API keys, like shown in the following image.
{
"name": "FalconSearchIOC",
"author": "Norgalades",
"license": "AGPL-V3",
"url": "https://github.com/",
"version": "1.0",
"description": "Check if an IOC (IP, domain or hash) has been seen in your CrowdStike environment.",
"dataTypeList": ["ip", "hash", "domain"],
"baseConfig": "FalconSearchIOC",
"command": "FalconSearchIOC/falcon_search_IOC.py",
"configurationItems": [
{
"name": "cs_api_off",
"description": "Office api",
"type": "string",
"multi": false,
"required": true
},
{
"name": "cs_api_aff",
"description": "Aff api",
"type": "string",
"multi": false,
"required": true
}
]
}
Hello, both issues are not related: the first one is a TheHive API thing, the second is Cortex-Analyzers related "issue".
password
, key
, apikey
, api_key
. We will improve this by allowing developers to flag a config as "Secret", so that cortexutils
can hide it in error messages.@norgalades can you please create this issue on Cortex-Analyzers
repository?
Thanks
Done @nadouani and thank you. If not already there, could you please also modify the page How to Write and Submit an Analyzer and specify that password, key, apikey, api_key are actually hidden config item? I was searching for this when writing the analyzer but I was not able to find the info in the docs.
Request Type
Bug
Work Environment
Problem Description
On specific API errors, the response from the server leaks sensible information back to the user.
Specifically, the local IP of the machine and its hostname, along with some indices.
Steps to Reproduce
Same as stated here: https://github.com/TheHive-Project/TheHive/issues/936
Possible Solutions
More strict error handling.
Complementary information
Every time there is an
Invalid search query
error from the server, the hostname and the local IP of the machine is leaked back to the user.Also some indices are exposed.
This is an example: