SCT-1001 @ 8626ed4 • vdaas / vald

Run summary

a year ago

8626ed4..8626ed4

3 mins 19 s

Hardcoded private key in source code SCT-1001

Secrets

Critical

2 occurrences in this check

Leaked "Private Key" detected in source: "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEA1ASsIQxxpco+RhToQ5ch+uwbFvZfwNq52ttVlZ6uvQDTfVpm\nohad9gvtga6hfA2MLT8qGk4F3flkPMJrY5WMKd+/D++N7wYH+rWs2WCmwmuz2bDT\nCwnSNCrq13+osDpAmO80EHDo4kk1FbX69NPSxYHPCgXbsQYshHtbV6Ddaq41GYLc\nv9ORLVtPUBRNl6lRUEuIzegguMIZjdye8lh8mb9ytZTtGngt9ZCDqsNPw8Q/w4/0\nTCQac9Kt43mCcLzN6xOAzWo01ugS4j1lZC1uB96WkROo2H8gkWsxPLSy1h8xhqj1\nlBJVdqyls3Vejp8lixcVgtkSv+9SLmUtVA6phwIDAQABAoIBAQCvuhus3LKJdmI9\nFfEYrHg2kGE3nAbrQp7OvgJmm3o7Hycre7UbXWGZYHN/i+0+c8AedH8CBG8qdx1U\nmtQFWxssTc3/eE8MsNQGQXQ9S7WL6VbM9JlHSeGW6YdyC9YWEoIeAA0IH312qLS+\nBPI24CaPGzMuHILla7eUKuYfcC50zuLcqZVrk3Mf/jQrAlc8YKaModGBn6DFw766\nz9k+04KDjmAc4iOoR9hD+8ELx+q0H4tPztRDLzJ7HOdPaBEbHT+xbV7KQb9gHa0F\nFQMvGAdQV/FxwDimLt/eY65+xqf4nSO+TtYnEH6TtAE3AW2SCj8+eFBigLxl1I0C\nVysm+wVhAoGBAO4Nnh7G9ZpFCQQ1aZuBDiCwIi/k4bSD53SI1t097d9DprCItq9Y\ntckza8oxsMnpY8t6/F9ab9tQzEz7NSOkRTo8sMc6yD6zpz0cz3WSbuw7E31u7HDx\nS300MMSW/ufINOjBmQGeIoMhCX2JZswiTy88vkV4UtA0oNEo4bp67FvxAoGBAOQA\nlc4qN2hE/o77qbWiPF8X7vQt6ulf4C4QO1Pyk3gYPFeqz0x9/EjGI9CVHUGuRbTb\npYYDfQgozRYnjz3iCU9g8DIY93SImpsQUm0k7QRHkWFa9s0Fp2ymn9PkASiJxQgk\n9l6CqTNUbGJLC1AI9LNAkr1WIzzX9lOOhEHFpTT3AoGAQOCbOF4W731jEK+R4ZyR\ngh0epBjn3m+Yc+0bSd6n5pIkarZHu5AcswH9nXRfbxfZZ8pT35ThKU9i7pQEDnul\nllKWByYhDt2ddY1ViQBolJ8hF61UaQ+J+ExyAhH41Kh+qvSgQ42acExfrsP0rSuo\nkwImBP7e6vl83qQaqNz5b7ECgYEAlgVUjKz2fCM5o/cveZXgR2nGDuDPuvMc3PJN\nNzVblx/LRJvdfqU/BNtq4WncMEVtFE2aIg3VjTLbjwJEnCFIovRT14LZ/9GKeRFK\nSwqK8c/tdrOVxN09hp40eAWERZoxDOTVPuaWUnHwRtS+AtGBwRhx9SbiVLx9Fgmm\nOGjGBY0CgYEAr2Go4s2QBQXpvJPdYSUGi/osF1jfntIL0JydqBOy9xx9R6d/CvWX\n8ekhlYdXLZPmgUoZ8EIBlULRs+8XJRn1zXGBUu1hEdU8rO7WdkHV6tJBIw6mSppV\nbtGQ8m0qKBLMJco77ZZCjp5lsG/Af308ojuK/DJcomH1slxyTkSYEjg=\n-----END RSA PRIVATE KEY-----"

internal/test/data/tls/dummyServer.key

 1-----BEGIN RSA PRIVATE KEY----- 2MIIEpQIBAAKCAQEA1ASsIQxxpco+RhToQ5ch+uwbFvZfwNq52ttVlZ6uvQDTfVpm 3ohad9gvtga6hfA2MLT8qGk4F3flkPMJrY5WMKd+/D++N7wYH+rWs2WCmwmuz2bDT 4CwnSNCrq13+osDpAmO80EHDo4kk1FbX69NPSxYHPCgXbsQYshHtbV6Ddaq41GYLc 5v9ORLVtPUBRNl6lRUEuIzegguMIZjdye8lh8mb9ytZTtGngt9ZCDqsNPw8Q/w4/0 6TCQac9Kt43mCcLzN6xOAzWo01ugS4j1lZC1uB96WkROo2H8gkWsxPLSy1h8xhqj1 7lBJVdqyls3Vejp8lixcVgtkSv+9SLmUtVA6phwIDAQABAoIBAQCvuhus3LKJdmI9 8FfEYrHg2kGE3nAbrQp7OvgJmm3o7Hycre7UbXWGZYHN/i+0+c8AedH8CBG8qdx1U 9mtQFWxssTc3/eE8MsNQGQXQ9S7WL6VbM9JlHSeGW6YdyC9YWEoIeAA0IH312qLS+10BPI24CaPGzMuHILla7eUKuYfcC50zuLcqZVrk3Mf/jQrAlc8YKaModGBn6DFw76611z9k+04KDjmAc4iOoR9hD+8ELx+q0H4tPztRDLzJ7HOdPaBEbHT+xbV7KQb9gHa0F12FQMvGAdQV/FxwDimLt/eY65+xqf4nSO+TtYnEH6TtAE3AW2SCj8+eFBigLxl1I0C13Vysm+wVhAoGBAO4Nnh7G9ZpFCQQ1aZuBDiCwIi/k4bSD53SI1t097d9DprCItq9Y14tckza8oxsMnpY8t6/F9ab9tQzEz7NSOkRTo8sMc6yD6zpz0cz3WSbuw7E31u7HDx15S300MMSW/ufINOjBmQGeIoMhCX2JZswiTy88vkV4UtA0oNEo4bp67FvxAoGBAOQA16lc4qN2hE/o77qbWiPF8X7vQt6ulf4C4QO1Pyk3gYPFeqz0x9/EjGI9CVHUGuRbTb17pYYDfQgozRYnjz3iCU9g8DIY93SImpsQUm0k7QRHkWFa9s0Fp2ymn9PkASiJxQgk189l6CqTNUbGJLC1AI9LNAkr1WIzzX9lOOhEHFpTT3AoGAQOCbOF4W731jEK+R4ZyR19gh0epBjn3m+Yc+0bSd6n5pIkarZHu5AcswH9nXRfbxfZZ8pT35ThKU9i7pQEDnul20llKWByYhDt2ddY1ViQBolJ8hF61UaQ+J+ExyAhH41Kh+qvSgQ42acExfrsP0rSuo21kwImBP7e6vl83qQaqNz5b7ECgYEAlgVUjKz2fCM5o/cveZXgR2nGDuDPuvMc3PJN22NzVblx/LRJvdfqU/BNtq4WncMEVtFE2aIg3VjTLbjwJEnCFIovRT14LZ/9GKeRFK23SwqK8c/tdrOVxN09hp40eAWERZoxDOTVPuaWUnHwRtS+AtGBwRhx9SbiVLx9Fgmm24OGjGBY0CgYEAr2Go4s2QBQXpvJPdYSUGi/osF1jfntIL0JydqBOy9xx9R6d/CvWX258ekhlYdXLZPmgUoZ8EIBlULRs+8XJRn1zXGBUu1hEdU8rO7WdkHV6tJBIw6mSppV26btGQ8m0qKBLMJco77ZZCjp5lsG/Af308ojuK/DJcomH1slxyTkSYEjg=27-----END RSA PRIVATE KEY-----

internal/servers/starter/testdata/dummyServer.key

 1-----BEGIN RSA PRIVATE KEY----- 2MIIEpQIBAAKCAQEA1ASsIQxxpco+RhToQ5ch+uwbFvZfwNq52ttVlZ6uvQDTfVpm 3ohad9gvtga6hfA2MLT8qGk4F3flkPMJrY5WMKd+/D++N7wYH+rWs2WCmwmuz2bDT 4CwnSNCrq13+osDpAmO80EHDo4kk1FbX69NPSxYHPCgXbsQYshHtbV6Ddaq41GYLc 5v9ORLVtPUBRNl6lRUEuIzegguMIZjdye8lh8mb9ytZTtGngt9ZCDqsNPw8Q/w4/0 6TCQac9Kt43mCcLzN6xOAzWo01ugS4j1lZC1uB96WkROo2H8gkWsxPLSy1h8xhqj1 7lBJVdqyls3Vejp8lixcVgtkSv+9SLmUtVA6phwIDAQABAoIBAQCvuhus3LKJdmI9 8FfEYrHg2kGE3nAbrQp7OvgJmm3o7Hycre7UbXWGZYHN/i+0+c8AedH8CBG8qdx1U 9mtQFWxssTc3/eE8MsNQGQXQ9S7WL6VbM9JlHSeGW6YdyC9YWEoIeAA0IH312qLS+10BPI24CaPGzMuHILla7eUKuYfcC50zuLcqZVrk3Mf/jQrAlc8YKaModGBn6DFw76611z9k+04KDjmAc4iOoR9hD+8ELx+q0H4tPztRDLzJ7HOdPaBEbHT+xbV7KQb9gHa0F12FQMvGAdQV/FxwDimLt/eY65+xqf4nSO+TtYnEH6TtAE3AW2SCj8+eFBigLxl1I0C13Vysm+wVhAoGBAO4Nnh7G9ZpFCQQ1aZuBDiCwIi/k4bSD53SI1t097d9DprCItq9Y14tckza8oxsMnpY8t6/F9ab9tQzEz7NSOkRTo8sMc6yD6zpz0cz3WSbuw7E31u7HDx15S300MMSW/ufINOjBmQGeIoMhCX2JZswiTy88vkV4UtA0oNEo4bp67FvxAoGBAOQA16lc4qN2hE/o77qbWiPF8X7vQt6ulf4C4QO1Pyk3gYPFeqz0x9/EjGI9CVHUGuRbTb17pYYDfQgozRYnjz3iCU9g8DIY93SImpsQUm0k7QRHkWFa9s0Fp2ymn9PkASiJxQgk189l6CqTNUbGJLC1AI9LNAkr1WIzzX9lOOhEHFpTT3AoGAQOCbOF4W731jEK+R4ZyR19gh0epBjn3m+Yc+0bSd6n5pIkarZHu5AcswH9nXRfbxfZZ8pT35ThKU9i7pQEDnul20llKWByYhDt2ddY1ViQBolJ8hF61UaQ+J+ExyAhH41Kh+qvSgQ42acExfrsP0rSuo21kwImBP7e6vl83qQaqNz5b7ECgYEAlgVUjKz2fCM5o/cveZXgR2nGDuDPuvMc3PJN22NzVblx/LRJvdfqU/BNtq4WncMEVtFE2aIg3VjTLbjwJEnCFIovRT14LZ/9GKeRFK23SwqK8c/tdrOVxN09hp40eAWERZoxDOTVPuaWUnHwRtS+AtGBwRhx9SbiVLx9Fgmm24OGjGBY0CgYEAr2Go4s2QBQXpvJPdYSUGi/osF1jfntIL0JydqBOy9xx9R6d/CvWX258ekhlYdXLZPmgUoZ8EIBlULRs+8XJRn1zXGBUu1hEdU8rO7WdkHV6tJBIw6mSppV26btGQ8m0qKBLMJco77ZZCjp5lsG/Af308ojuK/DJcomH1slxyTkSYEjg=27-----END RSA PRIVATE KEY-----

Description

Leaking private keys in the source code can have serious implications regarding the security of the application. An attacker can gain access to the sensitive data and use it to perform malicious activities. Private keys are meant to be kept secret and are used for encryption, decryption, and authentication purposes.

The best way to prevent the leakage of private keys is to remove them from the source code and store them in a secure location. Private keys should be stored outside the source code and loaded into memory when needed, e.g. through environment variables.

import os
import cryptography.hazmat.primitives.serialization as serialization
from cryptography.hazmat.primitives.asymmetric import rsa

def load_private_key():
    with open(os.getenv('PRIVATE_KEY_PATH'), 'rb') as key_file:
        private_key = serialization.load_pem_private_key(
            key_file.read(),
            password=os.getenv('PRIVATE_KEY_PASSWORD').encode(),
            backend=default_backend()
        )
    return private_key

vdaas / vald

Recommended