Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upJava: CWE-798 - Hardcoded AWS credentials #129
Comments
|
@xcorail As the PR of this issue was approved and closed about four weeks ago, would you please close this issue when you have a chance? Thanks in advance for your help. |
|
Your submission is now in status CodeQL review. For information, the evaluation workflow is the following: |
|
Your submission is now in status SecLab finalize. For information, the evaluation workflow is the following: |
|
Your submission is now in status Pay. For information, the evaluation workflow is the following: |
|
Created Hackerone report 956967 for bounty 237854 : [129] Java: CWE-798 - Hardcoded AWS credentials |
|
Your submission is now in status Closed. For information, the evaluation workflow is the following: |
|
Thanks @xcorail for looking into the issue and the quick turn-around. |
CVE ID(s)
List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.
Report
Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
Cloud services are being increasingly used in recent years, and AWS is one of the most popular service providers.
Authentication to AWS services, for example, the popular S3 cloud storage service, using the BasicAWSCredentials class of the Amazon client SDK library with hardcoded access key/secret key in Java code is against best practices and violates CWE-798.
Other approaches offered by AWS including AWS credentials file, environment variables, or instance/container credentials are more secure thus shall be used instead.
For more information, please refer to the AWS Developer Guide.
Related PR #3729