gitlab-secret_detection 0.46.1 → 0.47.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 8886f786b297458640202a8328790684081f1418ba9047a0361ef2bc84f109ba
|
|
4
|
+
data.tar.gz: 2e04665c9a6d4de50f8cc8f9301f57000f44b78480e169b0de6182e294bdbf45
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7ff5e4fa733280af7d0a274fed733955afcf190ef6d17d71c5197f73568608f62779126c1293095370e05d18bf1a8a329976af8d4ceaa6f39bb03ee4a2965c3f
|
|
7
|
+
data.tar.gz: e3f35df2419ed952f7b6f26b3bd14d48546dfaa1e7cb24e8a9a89c7420ff78d410876e2630074fdf8be66b86fa1affbb392597a30db7af770bb0213df1e0e7fa
|
data/README.md
CHANGED
|
@@ -1,20 +1,24 @@
|
|
|
1
|
-
# rule-set version: 0.
|
|
1
|
+
# rule-set version: 0.27.0
|
|
2
|
+
# Copyright (c) 2011-present GitLab B.V.
|
|
3
|
+
# Licensed under the MIT License.
|
|
2
4
|
# Rules are auto-generated. See https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-rules for instructions on updating the rules.
|
|
5
|
+
# ruleset variant: SPP-only
|
|
6
|
+
# This file contains secret detection rules enabled for Secret Push Protection.
|
|
3
7
|
[[rules]]
|
|
4
8
|
id = 'AdafruitIOKey'
|
|
5
9
|
regex = '\baio_[A-Za-z]{4}[0-9]{2}[0-9A-Za-z]{22}\b'
|
|
6
10
|
description = 'Adafruit IO Key'
|
|
7
11
|
title = 'Adafruit IO Key'
|
|
8
|
-
remediation = "For general guidance on handling security incidents with
|
|
12
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
|
|
9
13
|
tags = ['gitlab_blocking']
|
|
10
14
|
keywords = ['aio_']
|
|
11
15
|
|
|
12
16
|
[[rules]]
|
|
13
17
|
id = 'Adobe Client Secret'
|
|
14
18
|
regex = '\b(p8e-)[a-zA-Z0-9]{32}\b'
|
|
15
|
-
description = "An Adobe client secret
|
|
19
|
+
description = "An Adobe client secret. Adobe client secrets are used to connect to various API or webhook event based\nservices. Depending on which type of service was defined for a project, a malicious actor with access to the secret can\nuse it to gain access to various APIs or events that may contain sensitive information."
|
|
16
20
|
title = 'Adobe client secret'
|
|
17
|
-
remediation = "For general guidance on handling security incidents with
|
|
21
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nRemediation steps depend on which type of client secret was leaked, see the following\ntypes of remediation steps below and use the one that applies to the secret that was detected.\n\nOAuth (Server-to-Server):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Server-to-Server\"\n- Under \"Client Secret\" select \"Retrieve client secret\"\n- After the table of secrets is visible, below the table, select \"Add new client secret\"\n- After the new secret has been created, find the leaked token value and select the trash icon to remove it\n- Copy the secret value and update all services with the new client secret\n\nOAuth Web App (Event based project):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or select \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Web App\".\n- Select \"Retrieve client secret\"\n- Verify this is the leaked secret\n- If this project is configured for events, copy all event details before removing it. You can do this by finding the\n event listed on the right hand side and selecting on it. You should be brought to a dashboard that shows its details\n such as event delivery methods, providers, subscribed events, and connected Credentials.\n- To remove the event, select \"...\" in the event, which is on the right hand side of the project page, above\n \"Connect another service\".\n - Select \"remove\"\n - When prompted, type in the project name and select \"Delete Events Registration\"\n- In the top right-hand corner, select \"Delete credential\"\n - When prompted, type in the project name and select \"Delete Credential\"\n- Re-add the event with the same details as before\n - When prompted to add back the Credentials, be sure to use \"User Authentication\" OAuth\n - Select \"Web App\" for OAuth 2.0 authentication and authorization\n- After the event has been re-added, under \"Credentials\" on left hand side, select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- Copy the secret value and update all services with the new client secret\n\nOAuth Web App (API Service based project):\n\n- Sign in to your account at <https://developer.adobe.com/console>\n- Select the project or select \"All projects\" to find the project that is impacted\n- On the left-hand side, under \"Credentials\", select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- If this project is configured for API, select the trash icon \"Remove\" to remove the connected product and service.\n - When prompted, enter the project name and select \"Remove API\"\n- In the top right-hand corner, select \"Delete credential\"\n - When prompted, type in the project name and select \"Delete Credential\"\n- Re-add the API with the same details as before\n - Select \"Web App\" for OAuth 2.0 authentication and authorization\n- After the service has been re-added, on the left-hand side under \"Credentials\", select \"OAuth Web App\"\n- Select \"Retrieve client secret\"\n- Copy the secret value and update all services with the new client secret"
|
|
18
22
|
tags = ['gitlab_blocking']
|
|
19
23
|
keywords = ['p8e-']
|
|
20
24
|
|
|
@@ -23,88 +27,88 @@ id = 'AivenServicePassword'
|
|
|
23
27
|
regex = '\bAVNS_[0-9A-Za-z_-]{15,123}\b'
|
|
24
28
|
description = 'Aiven Service Password'
|
|
25
29
|
title = 'Aiven Service Password'
|
|
26
|
-
remediation = "For general guidance on handling security incidents with
|
|
30
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
|
|
27
31
|
tags = ['gitlab_blocking']
|
|
28
32
|
keywords = ['AVNS_']
|
|
29
33
|
|
|
30
34
|
[[rules]]
|
|
31
35
|
id = 'AmazonOAuthClientID'
|
|
32
36
|
regex = '\bamzn1\.application-oa2-client\.[a-fA-F0-9]{32}\b'
|
|
33
|
-
description = "An Amazon OAuth Client ID
|
|
37
|
+
description = "An Amazon OAuth Client ID. This credential is part of Amazon's Login with Amazon service\nand is used for OAuth 2.0 authentication flows to allow users to sign in using their Amazon\ncredentials. The Client ID is typically paired with a Client Secret for secure authentication. A\nmalicious actor with access to these credentials could potentially impersonate your application,\nredirect users to malicious sites, or access customer profile data that users have consented to share."
|
|
34
38
|
title = 'AmazonOAuthClientID'
|
|
35
|
-
remediation = "For general guidance on handling security incidents with
|
|
39
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your Amazon OAuth Client ID credentials:\n\n1. Log in to the Amazon Developer Console at <https://developer.amazon.com>\n2. Navigate to Apps & Services > My Apps, or go directly to the Login with Amazon console at\n <https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html>\n3. Locate the security profile associated with your compromised Client ID from the Security Profile\n Management table\n4. Click on the security profile name, then select \"Web Settings\" from the management options\n5. Click the \"Rotate Secret\" button to generate a new Client Secret (the Client ID remains the same)\n6. Update all applications, services, and configurations that use this Client ID with the new Client\n Secret\n7. Test your applications to ensure they can successfully authenticate with the new credentials\n8. The old Client Secret will expire automatically after 7 days, providing a grace period for\n updates\n\nFor detailed information on managing Amazon OAuth credentials and Login with Amazon security profiles,\nsee the\n[Login with Amazon Documentation](https://developer.amazon.com/docs/login-with-amazon/documentation-overview.html)."
|
|
36
40
|
tags = ['gitlab_blocking']
|
|
37
41
|
keywords = ['amzn1.application-oa2-client']
|
|
38
42
|
|
|
39
43
|
[[rules]]
|
|
40
44
|
id = 'anthropic_key'
|
|
41
45
|
regex = '\bsk-ant-[a-z]{3}\d{2}-[0-9A-Za-z_-]{94}[0-9A-Za-z_]\b'
|
|
42
|
-
description = "An Anthropic API key
|
|
46
|
+
description = "An Anthropic API key. Anthropic keys are used to access generative AI services. Malicious\nactors could use these keys to build up excessive charges to your account."
|
|
43
47
|
title = 'Anthropic API key'
|
|
44
|
-
remediation = "For general guidance on handling security incidents with
|
|
48
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo remediate a leaked Anthropic key, you should delete it from the list of API keys for your organization.\n\n- Sign in to your [Anthropic account](https://console.anthropic.com/)\n- Go to \"API settings\" by selecting your profile icon and then selecting \"API Keys\" or through the Settings tab\n- Identify the leaked API key and select the meatball menu (three horizontal dots) next to the key you want to delete\n- Select \"Delete API Key\"\n - Note: Deleting an API key is a permanent action and cannot be undone\n- Generate a new key by selecting \"Create Key\" and give it a descriptive name\n\nFor more information, see the Anthropic website: <https://support.anthropic.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised>."
|
|
45
49
|
tags = ['gitlab_blocking', 'client_side_sd']
|
|
46
50
|
keywords = ['sk-ant-']
|
|
47
51
|
|
|
48
52
|
[[rules]]
|
|
49
53
|
id = 'AsanaPersonalAccessTokenV2'
|
|
50
54
|
regex = '\b2\/[0-9]{16}\/[0-9]{16}:[0-9a-f]{32}\b'
|
|
51
|
-
description = "An Asana personal access token
|
|
55
|
+
description = "An Asana personal access token. Personal access tokens allow programmatic access to the Asana API. a\nmalicious actor who got access to this access token could execute functionality with the same permissions as that user."
|
|
52
56
|
title = 'Asana personal access token'
|
|
53
|
-
remediation = "For general guidance on handling security incidents with
|
|
57
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke the detected Asana personal access token:\n\n- Sign in to your developer account and access <https://app.asana.com/0/my-apps>\n- Find the token under the \"Personal access tokens\" section of the \"My apps\" page\n- Select \"View details\"\n- Select \"Delete\" in the \"Token details\" dialog\n\nFor more information, see [Asana developer documentation on personal access tokens](https://developers.asana.com/docs/personal-access-token)."
|
|
54
58
|
tags = ['gitlab_blocking']
|
|
55
59
|
keywords = ['2/']
|
|
56
60
|
|
|
57
61
|
[[rules]]
|
|
58
62
|
id = 'AsanaPersonalAccessTokenV1'
|
|
59
63
|
regex = '\b1\/[0-9]{14,16}:[0-9a-f]{32}\b'
|
|
60
|
-
description = "An Asana personal access token
|
|
64
|
+
description = "An Asana personal access token. Personal access tokens allow programmatic access to the Asana API. A\nmalicious actor who got access to this access token could execute functionality with the same permissions as that user."
|
|
61
65
|
title = 'Asana personal access token'
|
|
62
|
-
remediation = "For general guidance on handling security incidents with
|
|
66
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
|
|
63
67
|
tags = ['gitlab_blocking']
|
|
64
68
|
keywords = ['1/']
|
|
65
69
|
|
|
66
70
|
[[rules]]
|
|
67
71
|
id = 'AtlassianUserApiToken'
|
|
68
72
|
regex = '\bATATT3xFfGF0[0-9A-Za-z_-]{171}=[0-9A-F]{8}\b'
|
|
69
|
-
description = "An Atlassian User API token
|
|
73
|
+
description = "An Atlassian User API token. User tokens can be used in scripts or other processes to perform basic\nauthentication with Jira Cloud applications or Confluence Cloud. You should treat API tokens as securely as any other\npassword. A malicious actor with access to this token can compromise any repository or Atlassian service this user has\naccess to."
|
|
70
74
|
title = 'Atlassian user API token'
|
|
71
|
-
remediation = "For general guidance on handling security incidents with
|
|
75
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an Atlassian User API token:\n\n- Sign in to <https://id.atlassian.com/manage-profile/security/api-tokens>.\n- Select \"Revoke\" next to the API token that you want to revoke.\n\nSee [Atlassian help page](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/)\nfor more information on managing API tokens for your Atlassian account."
|
|
72
76
|
tags = ['gitlab_blocking']
|
|
73
77
|
keywords = ['ATATT3xFfGF0']
|
|
74
78
|
|
|
75
79
|
[[rules]]
|
|
76
80
|
id = 'AtlassianApiKey'
|
|
77
81
|
regex = '\bATCTT3xFfGN0[0-9A-Za-z_-]{171}=[0-9A-F]{8}\b'
|
|
78
|
-
description = "An Atlassian Admin API Key or Bitbucket Repository Access Token
|
|
82
|
+
description = "An Atlassian Admin API Key or Bitbucket Repository Access Token. These API keys allow you to manage your\norganization through the Atlassian Admin APIs.\n\n- For Admin API Keys a malicious actor can take over the entire organization's Atlassian products and services using\n this key.\n- For Bitbucket Repository Access Tokens, a malicious actor can gain the privileges assigned to the repository token\n which could be full access to a repository or just read access to certain aspects of the workspace."
|
|
79
83
|
title = 'Atlassian admin API key / Bitbucket repository access token'
|
|
80
|
-
remediation = "For general guidance on handling security incidents with
|
|
84
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an Atlassian Repository Token:\n\n- At <https://bitbucket.org>, go to the repository the access token was created for\n- In the sidebar, select \"Repository Settings\"\n- In the sidebar, under Security, select \"Access tokens\"\n- Find the access token and select \"Revoke\", then confirm that you want to revoke the token\n\nFor more information on revoking and creating Atlassian Bitbucket Repository Tokens, see their [documentation](https://support.atlassian.com/bitbucket-cloud/docs/create-a-repository-access-token/).\n\nTo revoke an Atlassian Admin API key:\n\n- Go to <https://admin.atlassian.com>\n- Select your organization if you have more than one\n- Select \"Settings > API keys\"\n- Select \"Revoke\" next to the API key\n\nFor more information on revoking and creating Atlassian Admin API Keys, see their [documentation](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/)."
|
|
81
85
|
tags = ['gitlab_blocking']
|
|
82
86
|
keywords = ['ATCTT3xFfGN0']
|
|
83
87
|
|
|
84
88
|
[[rules]]
|
|
85
89
|
id = 'AWS'
|
|
86
90
|
regex = '\b(?:AKIA|ASIA|A3T[A-Z0-9])[2-7A-Z]{16}\b'
|
|
87
|
-
description = "An AWS Access Key ID
|
|
91
|
+
description = "An AWS Access Key ID. AWS Access Key IDs come in different types: long-term IAM user access keys\n(starting with AKIA), temporary STS credentials (starting with ASIA), or AWS STS service bearer tokens. These\ncredentials are paired with Secret Access Keys to authenticate programmatic requests to AWS services. A\nmalicious actor with access to both the Access Key ID and its associated Secret Access Key can access AWS\nresources with the permissions granted to that credential, potentially leading to data breaches, resource\nmanipulation, or unauthorized charges."
|
|
88
92
|
title = 'AWS Access Key ID'
|
|
89
|
-
remediation = "For general guidance on handling security incidents with
|
|
93
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\n- **For Long-term IAM Access Keys (AKIA/A3T prefix)**:\n\nTo delete a long-term IAM access key:\n\n1. Log in to the AWS Management Console at <https://console.aws.amazon.com>\n2. Navigate to the IAM service by searching for \"IAM\" in the search bar or accessing it directly at\n <https://console.aws.amazon.com/iam>\n3. In the left navigation pane, select \"Users\" and locate the IAM user associated with the compromised key\n4. Select the username to view the user details page\n5. Navigate to the \"Security credentials\" tab\n6. In the \"Access keys\" section, find the key that matches the leaked Access Key ID\n7. Select \"Actions\" dropdown next to the key\n8. Select \"Deactivate\" to immediately disable the key, then select \"Delete\" to permanently remove it\n9. Generate a new access key pair if needed by selecting \"Create access key\"\n10. Update all applications, scripts, and systems that were using the compromised credentials with the new key\n11. Verify the old key is no longer active by checking the \"Access keys\" section shows the key as deleted\n\n- **For Temporary STS Credentials (ASIA prefix)**:\n\nTemporary credentials cannot be manually deleted but will expire automatically. To mitigate exposure:\n\n1. Log in to the AWS Management Console at <https://console.aws.amazon.com>\n2. Navigate to the IAM service at <https://console.aws.amazon.com/iam>\n3. Identify the IAM role or user that generated the temporary credentials by reviewing AWS CloudTrail logs\n4. If the credentials were generated via AssumeRole, consider attaching a deny policy to the role to prevent\n further access until credentials expire\n5. Review and reduce the session duration policy on the role to minimize exposure window for future sessions\n6. Monitor CloudTrail logs for any unauthorized activity during the credential validity period\n7. For immediate revocation, you can revoke active sessions by attaching an inline policy to the role with\n a condition that denies access for sessions created before the current time\n8. Update the trust policy or role permissions if the compromise indicates a broader security issue\n\n- **For All Access Key Types**:\n\nAfter remediation:\n\n1. Review AWS CloudTrail logs to identify any unauthorized activity that occurred using the compromised\n credentials at <https://console.aws.amazon.com/cloudtrail>\n2. Check for any unauthorized resource creation, modification, or data access\n3. Implement AWS CloudWatch alarms to detect unusual API activity patterns\n4. Consider enabling Amazon GuardDuty for continuous threat detection\n5. Review and update IAM policies to follow the principle of least privilege\n\nFor information on how to manage and revoke access keys for AWS, see their\n[official documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)\nand\n[STS temporary credentials documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)."
|
|
90
94
|
tags = ['aws', 'revocation_type', 'gitlab_blocking']
|
|
91
95
|
keywords = ['AKIA', 'ASIA', 'A3T']
|
|
92
96
|
|
|
93
97
|
[[rules]]
|
|
94
98
|
id = 'AWSBedrockKey'
|
|
95
99
|
regex = '\bABSK[A-Za-z0-9+/]{70,150}={0,2}'
|
|
96
|
-
description = "An AWS Bedrock Key
|
|
100
|
+
description = "An AWS Bedrock Key. AWS Bedrock Keys are usually paired along with their secret key values. A malicious\nactor with access to this token can access AWS services with the same permissions as the user which generated the key,\nprovided they have access to both values."
|
|
97
101
|
title = 'AWS Bedrock Key'
|
|
98
|
-
remediation = "For general guidance on handling security incidents with
|
|
102
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo delete an AWS Bedrock key:\n\n1. Sign in to the AWS Management Console and open the [Amazon Bedrock console](https://console.aws.amazon.com/bedrock/).\n1. In the left navigation pane, select **API keys.**\n1. In the **API keys for Amazon Bedrock** section, choose a key.\n1. Choose **Actions**.\n1. Select **Delete**.\n\nFor information on how to manage and revoke AWS Bedrock Keys, see the AWS [documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-revoke.html)."
|
|
99
103
|
tags = ['gitlab_blocking']
|
|
100
104
|
keywords = ['ABSK']
|
|
101
105
|
|
|
102
106
|
[[rules]]
|
|
103
107
|
id = 'AWSBedrockShortLivedKey'
|
|
104
108
|
regex = '\bbedrock-api-key-[A-Za-z0-9+/]{100,}={0,2}\b'
|
|
105
|
-
description = "An AWS Bedrock Short Lived Key
|
|
109
|
+
description = "An AWS Bedrock Short Lived Key. These are temporary credentials generated to access Amazon\nBedrock, AWS's managed service for foundation models and generative AI applications. Short-lived keys are\ntypically issued through AWS Security Token Service (STS) and include an access key ID, secret access key,\nand session token. A malicious actor with access to these credentials could invoke Bedrock models, access\ncustom models, or retrieve sensitive data within the permissions scope until the credentials expire."
|
|
106
110
|
title = 'AWS Bedrock Short Lived Key'
|
|
107
|
-
remediation = "For general guidance on handling security incidents with
|
|
111
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nShort-lived credentials cannot be manually revoked but will expire automatically based on their session\nduration. To mitigate exposure:\n\n1. Log in to the AWS Management Console at <https://console.aws.amazon.com>\n2. Navigate to AWS CloudTrail at <https://console.aws.amazon.com/cloudtrail> to identify the IAM entity\n (user or role) that generated the temporary credentials\n3. Review the CloudTrail event history for AssumeRole or GetSessionToken API calls that match the timeframe\n of credential creation\n4. Navigate to the IAM service at <https://console.aws.amazon.com/iam> and locate the source IAM role or\n user that generated the credentials\n5. For immediate mitigation, attach an inline deny policy to the IAM role or user to revoke active sessions\n by adding a condition that denies access for sessions created before the current time using the\n `aws:TokenIssueTime` condition key\n6. Review and reduce the maximum session duration on the IAM role to minimize future exposure windows by\n editing the role's \"Maximum session duration\" setting (minimum 1 hour, maximum 12 hours)\n7. Navigate to Amazon Bedrock at <https://console.aws.amazon.com/bedrock> and review recent API activity\n in the Bedrock service logs to identify any unauthorized model invocations or data access\n8. Monitor AWS CloudTrail logs continuously during the credential validity period for suspicious Bedrock\n API calls such as InvokeModel, InvokeModelWithResponseStream, or GetFoundationModelAvailability\n9. If unauthorized access is confirmed, review and update IAM policies following the principle of least\n privilege to restrict Bedrock permissions to only required models and actions\n10. Consider implementing AWS CloudWatch alarms to detect unusual Bedrock API usage patterns\n11. Enable Amazon GuardDuty if not already active for continuous threat detection across AWS services\n12. Update applications or systems that were using the compromised credentials once new credentials are\n generated through proper authentication flows\n\nFor detailed information on managing temporary credentials and Amazon Bedrock security, see the\n[AWS STS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)\nand\n[Amazon Bedrock security documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/security.html)."
|
|
108
112
|
tags = ['gitlab_blocking']
|
|
109
113
|
keywords = ['bedrock-api-key-']
|
|
110
114
|
|
|
@@ -113,7 +117,7 @@ id = 'AWSSessionToken'
|
|
|
113
117
|
regex = '\b(?:FwoGZXIvYXdzE|IQoJb3JpZ2luX2VjE|FQoDYXdzE)[A-Za-z0-9+/]{180,1000}={0,2}'
|
|
114
118
|
description = "An AWS Session Token is a temporary security credential that is part of AWS Security Token Service (STS)\ntemporary credentials. These tokens are used alongside temporary access key IDs and secret access keys to\nauthenticate requests to AWS services. While session tokens expire automatically, a malicious actor with\naccess to valid temporary credentials can access AWS resources with the same permissions as the assumed role\nor federated user until the token expires, potentially lasting from minutes to several hours."
|
|
115
119
|
title = 'AWS Session Token'
|
|
116
|
-
remediation = "For general guidance on handling security incidents with
|
|
120
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke your AWS Session Token:\n\n1. Log in to the AWS Management Console at <https://console.aws.amazon.com/>\n2. Navigate to the IAM service dashboard\n3. Identify the source of the temporary credentials:\n - For assumed roles: Go to \"Roles\" and locate the role that was assumed\n - For federated users: Check the identity provider configuration\n - For temporary credentials from GetSessionToken: Review the IAM user that generated them\n4. Revoke active sessions:\n - For roles: Select the role, go to \"Revoke sessions\" tab, and click \"Revoke active sessions\"\n - For IAM users: Go to \"Users\", select the user, \"Security credentials\" tab, and revoke sessions\n5. Update or remove any applications or scripts that were using the compromised temporary credentials\n6. Verify the session is no longer active by checking AWS CloudTrail logs for any API calls made with the\n compromised credentials after revocation\n7. Review and update the permissions or trust policies of the role or user to prevent future unauthorized\n access\n\nFor detailed information on managing temporary security credentials and revoking sessions, see the\n[AWS IAM documentation on temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)\nand [revoking IAM role sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html)."
|
|
117
121
|
tags = ['gitlab_blocking']
|
|
118
122
|
keywords = ['FwoGZXIvYXdzE', 'IQoJb3JpZ2luX2VjE', 'FQoDYXdzE']
|
|
119
123
|
|
|
@@ -129,9 +133,9 @@ keywords = ['8Q~']
|
|
|
129
133
|
[[rules]]
|
|
130
134
|
id = 'AzureAPIManagementGatewayKey'
|
|
131
135
|
regex = 'GatewayKey [A-Za-z0-9_-]{3,64}&[0-9]{12}&[A-Za-z0-9+\/]{60,90}=='
|
|
132
|
-
description = "An Azure API Management Gateway Key
|
|
136
|
+
description = "An Azure API Management Gateway Key. These keys provide access to APIs\npublished through Azure API Management services and are tied to specific subscriptions and products. A\nmalicious actor with access to this key can consume APIs within the configured rate limits and access\npolicies, potentially leading to unauthorized data access, service abuse, or unexpected charges."
|
|
133
137
|
title = 'Azure API Management Gateway Key'
|
|
134
|
-
remediation = "For general guidance on handling security incidents with
|
|
138
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo regenerate your Azure API Management Gateway Key:\n\n1. Log in to the [Azure Portal](https://portal.azure.com)\n2. Navigate to your API Management service instance\n3. In the left menu, select \"Subscriptions\" under the \"APIs\" section\n4. Locate the compromised subscription by matching the key prefix or subscription name\n5. Click on the subscription name to open its details\n6. In the subscription details, click \"Regenerate primary key\" or \"Regenerate secondary key\"\n (regenerate the compromised key)\n7. Update all applications and clients that use this subscription key with the new key value\n8. Monitor API usage logs to verify the old key is no longer being used\n9. Consider temporarily disabling the subscription if immediate key rotation isn't possible\n\nFor detailed information on managing Azure API Management subscriptions and keys, see the\n[Azure API Management documentation](https://docs.microsoft.com/en-us/azure/api-management/api-management-subscriptions)."
|
|
135
139
|
tags = ['gitlab_blocking']
|
|
136
140
|
keywords = ['GatewayKey']
|
|
137
141
|
|
|
@@ -379,34 +383,34 @@ keywords = ['v1.']
|
|
|
379
383
|
|
|
380
384
|
[[rules]]
|
|
381
385
|
id = 'gitlab_personal_access_token'
|
|
382
|
-
regex = '\b(glpat-[0-9a-zA-Z_\-]{20})(?:[
|
|
386
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glpat-[0-9a-zA-Z_\-]{20})(?:[^0-9a-zA-Z_\-]|$)'
|
|
383
387
|
description = "A GitLab personal access token was identified. Personal access tokens can be used to access GitLab services\nas the user who created them. In most cases these tokens are given read-write access to all repositories. A malicious\nactor with access to this token can execute functionality on behalf of the user with the given permissions of the token."
|
|
384
388
|
title = 'GitLab personal access token'
|
|
385
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
389
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a personal access token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Personal access tokens**.\n1. Note the permissions assigned to the identified token, then select the vertical ellipsis icon next to it.\n1. Select **Revoke**.\n1. On the confirmation dialog, select **Revoke**."
|
|
386
390
|
tags = ['gitlab', 'revocation_type', 'gitlab_blocking', 'client_side_sd']
|
|
387
391
|
keywords = ['glpat']
|
|
388
392
|
|
|
389
393
|
[[rules]]
|
|
390
394
|
id = 'gitlab_personal_access_token_routable'
|
|
391
|
-
regex = '\
|
|
392
|
-
description =
|
|
393
|
-
title = 'GitLab
|
|
394
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
395
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glpat-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
396
|
+
description = "A GitLab personal access token was identified. This is the routable token format, which encodes cell-routing\ninformation alongside the token secret so requests can be sent to the correct GitLab cell. Functionally it behaves\nexactly like a standard personal access token (`glpat-...`): it can be used to access GitLab services as the user\nwho created it, and in most cases is given read-write access to all repositories. A malicious actor with access to\nthis token can execute functionality on behalf of the user with the given permissions of the token."
|
|
397
|
+
title = 'GitLab personal access token (routable)'
|
|
398
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a personal access token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Personal access tokens**.\n1. Note the permissions assigned to the identified token, then select the vertical ellipsis icon next to it.\n1. Select **Revoke**.\n1. On the confirmation dialog, select **Revoke**."
|
|
395
399
|
tags = ['gitlab', 'revocation_type', 'gitlab_blocking', 'client_side_sd']
|
|
396
400
|
keywords = ['glpat-']
|
|
397
401
|
|
|
398
402
|
[[rules]]
|
|
399
403
|
id = 'gitlab_personal_access_token_routable_versioned'
|
|
400
|
-
regex = '\
|
|
401
|
-
description =
|
|
402
|
-
title = 'GitLab
|
|
403
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
404
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glpat-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
405
|
+
description = "A GitLab personal access token was identified. This is the routable and versioned token format, which encodes\ncell-routing information and a format version segment alongside the token secret so requests can be sent to the\ncorrect GitLab cell. Functionally it behaves exactly like a standard personal access token (`glpat-...`): it can be\nused to access GitLab services as the user who created it, and in most cases is given read-write access to all\nrepositories. A malicious actor with access to this token can execute functionality on behalf of the user with the\ngiven permissions of the token."
|
|
406
|
+
title = 'GitLab personal access token (routable, versioned)'
|
|
407
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a personal access token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Personal access tokens**.\n1. Note the permissions assigned to the identified token, then select the vertical ellipsis icon next to it.\n1. Select **Revoke**.\n1. On the confirmation dialog, select **Revoke**."
|
|
404
408
|
tags = ['gitlab', 'revocation_type', 'gitlab_blocking', 'client_side_sd']
|
|
405
409
|
keywords = ['glpat-']
|
|
406
410
|
|
|
407
411
|
[[rules]]
|
|
408
412
|
id = 'gitlab_pipeline_trigger_token'
|
|
409
|
-
regex = '\b(glptt-(?:[0-9a-zA-Z_\-]{20}|[0-9a-zA-Z_\-]{40}))(?:[
|
|
413
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glptt-(?:[0-9a-zA-Z_\-]{20}|[0-9a-zA-Z_\-]{40}))(?:[^0-9a-zA-Z_\-]|$)'
|
|
410
414
|
description = "A GitLab pipeline trigger token was identified. Pipeline trigger tokens can be used to execute pipelines for a branch\nor tag of a project. The token impersonates a user's project access and permissions. A malicious actor with access to\nthis token can execute pipelines with custom variables, potentially being able to compromise the repository."
|
|
411
415
|
title = 'GitLab pipeline trigger token'
|
|
412
416
|
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a pipeline trigger token:\n\n- Sign in to your GitLab account and visit the project that created the pipeline trigger token\n- In the left-hand menu, select \"Settings\"\n- Under the \"Settings\" options, select \"CI/CD\"\n- Under the \"Pipeline trigger tokens\" section find the identified token\n- Select the trash icon in the \"Actions\" column of the \"Active pipeline trigger tokens\" table\n- When prompted, select \"Revoke trigger\"\n\nFor more information, please see [GitLabs documentation on pipeline trigger tokens](https://docs.gitlab.com/ee/ci/triggers/index.html#create-a-pipeline-trigger-token)."
|
|
@@ -424,21 +428,21 @@ keywords = ['GR1348941']
|
|
|
424
428
|
|
|
425
429
|
[[rules]]
|
|
426
430
|
id = 'gitlab_runner_auth_token'
|
|
427
|
-
regex = '\b(
|
|
428
|
-
description = "A GitLab runner authentication token was identified.
|
|
431
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glrtr?-(?:t[1-3]_)?[0-9a-zA-Z_\-]{20})(?:[^0-9a-zA-Z_\-]|$)'
|
|
432
|
+
description = "A GitLab runner authentication token was identified. This rule matches the non-routable formats:\n\n- `glrt-` followed by 20 characters, for runners created in the GitLab UI or API. GitLab made this format before it\n used routable runner tokens. It still makes it for a runner that has no owner.\n- `glrtr-` followed by 20 characters, for runners registered with a runner registration token.\n- `glrt-t1_`, `glrt-t2_` or `glrt-t3_` followed by 20 characters, a legacy format from older GitLab versions.\n\nIf the instance has an instance token prefix, a `glrt-` token can start with that prefix and a hyphen, for example\n`acme-glrt-`. `glrtr-` tokens do not get this prefix.\n\nA runner uses this token to authenticate with GitLab and to pick up CI/CD jobs. A malicious actor with access to this\ntoken can authenticate as the runner and take its CI/CD jobs. The actor can then read job variables and secrets, and\ncan change job output."
|
|
429
433
|
title = 'GitLab runner authentication token'
|
|
430
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
434
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo reset a runner authentication token, delete the runner and create a new runner:\n\n1. Go to the runner list:\n - For a project runner: find your project, and in the left sidebar select **Settings** > **CI/CD**. Expand\n **Runners**.\n - For a group runner: find your group, and in the left sidebar select **Build** > **Runners**.\n - For an instance runner: in the upper-right corner select **Admin**, and in the left sidebar select **CI/CD** >\n **Runners**.\n1. Find the runner that uses the identified token. The list shows each runner as `#<ID> (<short token>)`. The short\n token is the first 8 characters after the token prefix, for example after `glrt-`, `glrtr-` or `t1_`.\n1. Delete the runner:\n - For a group runner or an instance runner, next to the runner, select **Delete runner** (remove icon).\n - For a project runner, in the **Assigned project runners** section, select **Remove runner**, then select\n **Remove**. If the runner is enabled in more than one project, disable it in the other projects first.\n1. Create a new runner. GitLab gives the new runner a new authentication token.\n1. On the runner host, register the new runner. To stop the old runner from contacting GitLab, unregister the\n deleted runner from the `config.toml` file.\n1. Optional. To verify that GitLab revoked the old token, use the\n [Runners API](https://docs.gitlab.com/api/runners/#verify-authentication-for-a-registered-runner).\n\nFor more information, see\n[Reset the runner configuration authentication token](https://docs.gitlab.com/ci/runners/configure_runners/#reset-the-runner-configuration-authentication-token)."
|
|
431
435
|
tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
|
|
432
436
|
keywords = ['glrt']
|
|
433
437
|
|
|
434
438
|
[[rules]]
|
|
435
439
|
id = 'gitlab_runner_auth_token_routable'
|
|
436
|
-
regex = '\
|
|
437
|
-
description = "A routable GitLab runner authentication token was identified.
|
|
440
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glrtr?-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
441
|
+
description = "A routable GitLab runner authentication token was identified. The token starts with `glrt-`, or with `glrtr-`\nwhen the runner was registered with a runner registration token. The token encodes cell-routing information alongside\nthe token secret.\n\nA runner uses this token to authenticate with GitLab and to pick up CI/CD jobs. A malicious actor with access to this\ntoken can authenticate as the runner and take its CI/CD jobs. The actor can then read job variables and secrets, and\ncan change job output."
|
|
438
442
|
title = 'GitLab runner authentication token (routable)'
|
|
439
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
443
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo reset a runner authentication token, delete the runner and create a new runner:\n\n1. Go to the runner list:\n - For a project runner: find your project, and in the left sidebar select **Settings** > **CI/CD**. Expand\n **Runners**.\n - For a group runner: find your group, and in the left sidebar select **Build** > **Runners**.\n - For an instance runner: in the upper-right corner select **Admin**, and in the left sidebar select **CI/CD** >\n **Runners**.\n1. Find the runner that uses the identified token. The list shows each runner as `#<ID> (<short token>)`. The short\n token is the first 8 characters after the token prefix, for example after `glrt-`, `glrtr-` or `t1_`.\n1. Delete the runner:\n - For a group runner or an instance runner, next to the runner, select **Delete runner** (remove icon).\n - For a project runner, in the **Assigned project runners** section, select **Remove runner**, then select\n **Remove**. If the runner is enabled in more than one project, disable it in the other projects first.\n1. Create a new runner. GitLab gives the new runner a new authentication token.\n1. On the runner host, register the new runner. To stop the old runner from contacting GitLab, unregister the\n deleted runner from the `config.toml` file.\n1. Optional. To verify that GitLab revoked the old token, use the\n [Runners API](https://docs.gitlab.com/api/runners/#verify-authentication-for-a-registered-runner).\n\nFor more information, see\n[Reset the runner configuration authentication token](https://docs.gitlab.com/ci/runners/configure_runners/#reset-the-runner-configuration-authentication-token)."
|
|
440
444
|
tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
|
|
441
|
-
keywords = ['glrt
|
|
445
|
+
keywords = ['glrt']
|
|
442
446
|
|
|
443
447
|
[[rules]]
|
|
444
448
|
id = 'gitlab_oauth_app_secret'
|
|
@@ -460,7 +464,7 @@ keywords = ['glft']
|
|
|
460
464
|
|
|
461
465
|
[[rules]]
|
|
462
466
|
id = 'gitlab_kubernetes_agent_token'
|
|
463
|
-
regex = '\b(glagent-[0-9a-zA-Z_\-]{50})(?:[
|
|
467
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glagent-[0-9a-zA-Z_\-]{50})(?:[^0-9a-zA-Z_\-.]|\.[^0-9a-z]|\.$|$)'
|
|
464
468
|
description = "A GitLab Agent for Kubernetes token was identified. The Kubernetes access token is used to authenticate the GitLab agent\nwith a Kubernetes cluster. A malicious actor with access to this token can access source code in the agent's\nconfiguration project, access source code in any public project on the GitLab instance, or even, under very specific\nconditions, obtain a Kubernetes manifest."
|
|
465
469
|
title = 'GitLab Kubernetes agent token'
|
|
466
470
|
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor more information please see [GitLabs documentation on rotating the Kubernetes agent token](https://docs.gitlab.com/ee/user/clusters/agent/work_with_agent.html#reset-the-agent-token)."
|
|
@@ -469,13 +473,139 @@ keywords = ['glagent']
|
|
|
469
473
|
|
|
470
474
|
[[rules]]
|
|
471
475
|
id = 'gitlab_incoming_email_token'
|
|
472
|
-
regex = '\b(glimt-[0-9a-
|
|
473
|
-
description = "A GitLab incoming email token was identified. Your incoming email token authenticates you when you create a new issue\
|
|
476
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glimt-[0-9a-z]{20,25})(?:[^0-9a-zA-Z_\-]|$)'
|
|
477
|
+
description = "A GitLab incoming email token was identified. Your incoming email token authenticates you when you create a new issue\nor merge request by email, and is included in your personal project-specific email addresses. It cannot be used to\naccess any other data. A malicious actor with access to this token can create issues and merge requests as if they\nwere you."
|
|
474
478
|
title = 'GitLab incoming email token'
|
|
475
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys,
|
|
479
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo reset an incoming email token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Personal access tokens**.\n1. Under **Incoming email token**, select **reset this token**.\n\nFor more information, see the [GitLab documentation on incoming email tokens](https://docs.gitlab.com/ee/security/tokens/#incoming-email-token)."
|
|
476
480
|
tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
|
|
477
481
|
keywords = ['glimt']
|
|
478
482
|
|
|
483
|
+
[[rules]]
|
|
484
|
+
id = 'gitlab_deploy_token'
|
|
485
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?gldt-[0-9a-zA-Z_\-]{20})(?:[^0-9a-zA-Z_\-]|$)'
|
|
486
|
+
description = "A GitLab deploy token was identified. A deploy token enables authentication of deployment tasks, independent of a user\naccount. With a deploy token, automated tasks can:\n\n- Clone Git repositories\n- Pull from and push to a GitLab container registry\n- Pull from and push to a GitLab package registry\n\nA malicious actor with access to this token can access git repositories or compromise released packages or containers."
|
|
487
|
+
title = 'GitLab deploy token'
|
|
488
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor more information, please see [GitLabs documentation on revoking deploy tokens](https://docs.gitlab.com/ee/user/project/deploy_tokens/#revoke-a-deploy-token)."
|
|
489
|
+
tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
|
|
490
|
+
keywords = ['gldt']
|
|
491
|
+
|
|
492
|
+
[[rules]]
|
|
493
|
+
id = 'gitlab_deploy_token_routable'
|
|
494
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?gldt-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
495
|
+
description = "A routable GitLab deploy token was identified. The token starts with `gldt-` and encodes cell-routing\ninformation alongside the token secret. Functionally it behaves like a standard deploy token. With a deploy token,\nautomated tasks can:\n\n- Clone Git repositories\n- Pull from and push to a GitLab container registry\n- Pull from and push to a GitLab package registry\n\nA malicious actor with access to this token can read repositories or change released packages or containers."
|
|
496
|
+
title = 'GitLab deploy token (routable)'
|
|
497
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a deploy token:\n\n1. In the top bar, select **Search or go to** and find your project or group.\n1. In the left sidebar, select **Settings** > **Repository**.\n1. Expand **Deploy tokens**.\n1. In the **Active deploy tokens** section, find the token by its **Username**. Select **Revoke**.\n1. In the dialog, select **Revoke** followed by the token name.\n\nTo revoke a group deploy token, you must have the Owner role for the group. To revoke a project deploy token, you must\nhave the Maintainer or Owner role for the project.\n\nFor more information, see [Revoke a deploy token](https://docs.gitlab.com/user/project/deploy_tokens/#revoke-a-deploy-token)."
|
|
498
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
499
|
+
keywords = ['gldt-']
|
|
500
|
+
|
|
501
|
+
[[rules]]
|
|
502
|
+
id = 'gitlab_deploy_token_in_url'
|
|
503
|
+
regex = 'gitlab\+deploy-token-[0-9]+:([0-9a-zA-Z_\-]{20})@'
|
|
504
|
+
description = "A GitLab deploy token was identified in a URL that uses the default deploy token username,\n`gitlab+deploy-token-<ID>`. This rule finds deploy tokens that GitLab created before it added the `gldt-` prefix.\nThese tokens have no prefix, and by default they do not expire.\n\nA deploy token can clone repositories, and can read from or write to the container registry and the package registry.\nA malicious actor with access to this token can read repositories or change released packages or containers."
|
|
505
|
+
title = 'GitLab deploy token in a Git URL'
|
|
506
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a deploy token:\n\n1. In the top bar, select **Search or go to** and find your project or group.\n1. In the left sidebar, select **Settings** > **Repository**.\n1. Expand **Deploy tokens**.\n1. In the **Active deploy tokens** section, find the token by its **Username**. Select **Revoke**.\n1. In the dialog, select **Revoke** followed by the token name.\n\nTo revoke a group deploy token, you must have the Owner role for the group. To revoke a project deploy token, you must\nhave the Maintainer or Owner role for the project.\n\nFor more information, see [Revoke a deploy token](https://docs.gitlab.com/user/project/deploy_tokens/#revoke-a-deploy-token)."
|
|
507
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
508
|
+
keywords = ['gitlab+deploy-token-']
|
|
509
|
+
|
|
510
|
+
[[rules]]
|
|
511
|
+
id = 'gitlab_kubernetes_agent_token_routable'
|
|
512
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glagent-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
513
|
+
description = "A routable GitLab agent for Kubernetes token was identified. The token starts with `glagent-` and encodes\ncell-routing information alongside the token secret. GitLab creates all new agent tokens in this format.\n\nThe agent uses this token to connect to GitLab. A malicious actor with access to this token can connect to GitLab as\nthe agent. The actor can read source code in the agent configuration project and in public projects. In some\nconditions, the actor can get Kubernetes manifests."
|
|
514
|
+
title = 'GitLab Kubernetes agent token (routable)'
|
|
515
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo reset the agent token, you must have the Maintainer or Owner role for the project:\n\n1. In the top bar, select **Search or go to** and find your project.\n1. Select **Operate** > **Kubernetes clusters**.\n1. Select the agent.\n1. On the **Access tokens** tab, select **Create token**. Enter a name and select **Create token**.\n1. Install the new token in your cluster.\n1. Return to the token list. By the identified token, select **Revoke token** (remove icon).\n1. Type the token name, then select **Revoke token**.\n\nAn agent can have only two active tokens at one time. If the agent already has two, revoke the identified token\nfirst. The token list does not show token values. To find the token from its value, an administrator can use the\nRails console. See [GitLab cluster agent tokens](https://docs.gitlab.com/security/tokens/#gitlab-cluster-agent-tokens).\n\nFor more information, see [Reset the agent token](https://docs.gitlab.com/user/clusters/agent/work_with_agent/#reset-the-agent-token)."
|
|
516
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
517
|
+
keywords = ['glagent-']
|
|
518
|
+
|
|
519
|
+
[[rules]]
|
|
520
|
+
id = 'gitlab_workspace_token'
|
|
521
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glwt-[0-9a-zA-Z_\-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7})\b'
|
|
522
|
+
description = "A GitLab workspace token was identified. The token starts with `glwt-` and is a routable token. GitLab\ncreates a workspace token when a workspace starts, and deletes it when the workspace stops. The workspace agent\n(`agentw`) runs in the workspace. It uses the token to connect to the GitLab agent server (KAS).\n\nA malicious actor with access to this token can send requests as the workspace while the workspace runs."
|
|
523
|
+
title = 'GitLab workspace token'
|
|
524
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a workspace token, stop or terminate the workspace that owns it. GitLab deletes the workspace\ntoken when the workspace is no longer in the running state. When you start the workspace again, GitLab creates a new\ntoken.\n\n1. In the top bar, select **Search or go to** and find your project.\n1. In the upper right, select **Code**.\n1. From the dropdown list, under **Your workspaces**, find the workspace where the token leaked.\n1. Stop or terminate the workspace. When you terminate a workspace, GitLab deletes any uncommitted data in it.\n\nTo stop another user's workspace, select **Operate** > **Kubernetes clusters**, select the agent, then select the\n**Workspaces** tab.\n\nEach workspace also has a personal access token with the `api` and `write_repository` scopes. Stopping the workspace\ndoes not revoke it. If this token can also have leaked, terminate the workspace.\n\nFor more information, see [Workspaces](https://docs.gitlab.com/user/workspace/)."
|
|
525
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
526
|
+
keywords = ['glwt-']
|
|
527
|
+
|
|
528
|
+
[[rules]]
|
|
529
|
+
id = 'gitlab_feature_flags_client_token'
|
|
530
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glffct-[0-9a-zA-Z_\-]{20})(?:[^0-9a-zA-Z_\-]|$)'
|
|
531
|
+
description = "A GitLab feature flags client token was identified. The token starts with `glffct-`. In the GitLab UI it is\nshown as the **Instance ID** of the project's feature flags. Applications use it with an Unleash client to get the\nfeature flags of the project.\n\nA malicious actor with access to this token can read all feature flags of the project and their strategies. This can\nshow unreleased features and their names. Strategies that use user lists also show user IDs."
|
|
532
|
+
title = 'GitLab feature flags client token'
|
|
533
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo regenerate the feature flags instance ID, you must have the Maintainer or Owner role for the project.\n\n1. In the top bar, select **Search or go to** and find your project.\n1. In the left sidebar, select **Deploy** > **Feature flags**.\n1. Select **Configure**.\n1. Type the project name to confirm, then select **Regenerate instance ID**.\n1. Update your applications to use the new instance ID.\n\nFor more information, see [Get access credentials](https://docs.gitlab.com/operations/feature_flags/#get-access-credentials)."
|
|
534
|
+
tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
|
|
535
|
+
keywords = ['glffct-']
|
|
536
|
+
|
|
537
|
+
[[rules]]
|
|
538
|
+
id = 'gitlab_runner_controller_token'
|
|
539
|
+
regex = '\b((?:[a-zA-Z0-9]{1,20}-)?glrct-[0-9a-zA-Z_\-]{20})(?:[^0-9a-zA-Z_\-]|$)'
|
|
540
|
+
description = "A GitLab runner controller token was identified. The token starts with `glrct-`. A runner controller uses\nthis token to connect to the job router. The job router is part of GitLab Relay (KAS). Runner controllers are an\nExperiment in GitLab Ultimate on GitLab Self-Managed and GitLab Dedicated.\n\nA malicious actor with access to this token can authenticate as the runner controller."
|
|
541
|
+
title = 'GitLab runner controller token'
|
|
542
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke or rotate a runner controller token, use the runner controller tokens API. You must have administrator\naccess to the GitLab instance.\n\nTo revoke the token:\n\n```shell\ncurl --request DELETE \\\n --header \"PRIVATE-TOKEN: <your_access_token>\" \\\n --url \"https://gitlab.example.com/api/v4/runner_controllers/:id/tokens/:token_id\"\n```\n\nTo rotate the token, send `POST /runner_controllers/:id/tokens/:token_id/rotate`. GitLab revokes the old token and\nreturns a new token.\n\nFor more information, see [Runner controller tokens API](https://docs.gitlab.com/api/runner_controller_tokens/)."
|
|
543
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
544
|
+
keywords = ['glrct-']
|
|
545
|
+
|
|
546
|
+
[[rules]]
|
|
547
|
+
id = 'gitlab_ci_build_token_jwt'
|
|
548
|
+
regex = '\b(?:[a-zA-Z0-9]{1,20}-)?glcbt-eyJ[0-9a-zA-Z_\-]{10,1000}\.eyJ[0-9a-zA-Z_\-]{10,1000}\.[0-9a-zA-Z_\-]{20,1000}'
|
|
549
|
+
description = "A GitLab CI/CD job token in JSON Web Token (JWT) format was identified. The token starts with `glcbt-`\nfollowed by a JWT. New top-level groups use this format by default. A top-level group can turn it off with the\n**Enable JWT format for CI/CD job tokens** setting. GitLab always uses this format for users with composite identity,\nsuch as GitLab Duo agents.\n\nA job uses this token to authenticate with GitLab during the job. A malicious actor with access to this token can use\nthe permissions of the job until the job finishes."
|
|
550
|
+
title = 'GitLab CI/CD job token (JWT)'
|
|
551
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nA job token is valid only while the job runs. After the job finishes, GitLab revokes the token.\n\nIf the job still runs, cancel it. You must have the Developer, Maintainer, or Owner role for the project, or the\nminimum role that your project sets to cancel jobs.\n\n1. In the top bar, select **Search or go to** and find your project.\n1. In the left sidebar, select **Build** > **Jobs**.\n1. Find the job and select **Cancel**.\n\nThe token stays valid until the job stops, which includes the time that `after_script` runs.\n\nRemove the token from the place where it leaked, for example a job log or an artifact. For more information, see\n[GitLab CI/CD job token](https://docs.gitlab.com/ci/jobs/ci_job_token/)."
|
|
552
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
553
|
+
keywords = ['glcbt-']
|
|
554
|
+
|
|
555
|
+
[[rules]]
|
|
556
|
+
id = 'gitlab_stateless_access_token'
|
|
557
|
+
regex = '\b(?:[a-zA-Z0-9]{1,20}-)?glsat-eyJ[0-9a-zA-Z_\-]{10,1000}\.eyJ[0-9a-zA-Z_\-]{10,1000}\.[0-9a-zA-Z_\-]{20,1000}'
|
|
558
|
+
description = "A GitLab stateless access token was identified. The token starts with `glsat-` followed by a JSON Web Token\n(JWT). GitLab issues this token to the GitLab Duo Agent Platform, for example for a GitLab Duo Workflow session. The\ntoken is valid for 2 hours, or 1 hour for a composite identity token.\n\nA malicious actor with access to this token can use the GitLab API with the scopes of the token until it expires."
|
|
559
|
+
title = 'GitLab stateless access token'
|
|
560
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nNo UI revokes a stateless access token. The token expires 2 hours after GitLab issues it, or 1 hour for a\ncomposite identity token.\n\n1. Cancel the GitLab Duo session that uses the token. This stops the CI/CD pipelines of the session, but it does\n not revoke the token directly:\n 1. In the top bar, select **Search or go to** and find your project.\n 1. In the left sidebar, select **AI** > **Sessions**.\n 1. On the **Details** tab, select **Cancel session**.\n 1. In the confirmation dialog, select **Cancel session**.\n1. Remove the token from the place where it leaked.\n1. If you think someone used the token, check the audit events and the activity of the user that the token belongs\n to."
|
|
561
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
562
|
+
keywords = ['glsat-']
|
|
563
|
+
|
|
564
|
+
[[rules]]
|
|
565
|
+
id = 'gitlab_iam_access_token'
|
|
566
|
+
regex = '\bgliamat-eyJ[0-9a-zA-Z_\-]{10,1000}\.eyJ[0-9a-zA-Z_\-]{10,1000}\.[0-9a-zA-Z_\-]{20,1000}'
|
|
567
|
+
description = "A GitLab IAM OAuth access token was identified. The token starts with `gliamat-` followed by a JSON Web Token\n(JWT). The GitLab IAM service issues this token through OAuth. The IAM service is not generally available yet.\n\nA malicious actor with access to this token can use the GitLab API with the scopes of the token until it expires."
|
|
568
|
+
title = 'GitLab IAM OAuth access token'
|
|
569
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke the OAuth authorization of the application that received the token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Applications**.\n1. In the **Authorized applications** section, by the application, select **Revoke**.\n\nThis also revokes the tokens that the IAM service issued to that application for you.\n\nFor more information, see\n[View all authorized applications](https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications)."
|
|
570
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
571
|
+
keywords = ['gliamat-']
|
|
572
|
+
|
|
573
|
+
[[rules]]
|
|
574
|
+
id = 'gitlab_iam_refresh_token'
|
|
575
|
+
regex = '\b(gliamrt-[0-9a-zA-Z_\-]{43}\.[0-9a-zA-Z_\-]{43})(?:[^0-9a-zA-Z_\-]|$)'
|
|
576
|
+
description = "A GitLab IAM OAuth refresh token was identified. The token starts with `gliamrt-`. The GitLab IAM service\nissues this token through OAuth. A client uses it to get new access tokens. The IAM service is not generally\navailable yet.\n\nA malicious actor with access to this token can get new access tokens for the user."
|
|
577
|
+
title = 'GitLab IAM OAuth refresh token'
|
|
578
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke the OAuth authorization of the application that received the token:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Applications**.\n1. In the **Authorized applications** section, by the application, select **Revoke**.\n\nThis also revokes the tokens that the IAM service issued to that application for you.\n\nFor more information, see\n[View all authorized applications](https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications)."
|
|
579
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
580
|
+
keywords = ['gliamrt-']
|
|
581
|
+
|
|
582
|
+
[[rules]]
|
|
583
|
+
id = 'gitlab_iam_authorization_code'
|
|
584
|
+
regex = '\b(gliamac-[0-9a-zA-Z_\-]{43}\.[0-9a-zA-Z_\-]{43})(?:[^0-9a-zA-Z_\-]|$)'
|
|
585
|
+
description = "A GitLab IAM OAuth authorization code was identified. The code starts with `gliamac-`. The GitLab IAM\nservice issues it during an OAuth sign-in, and a client exchanges it for tokens. The IAM service is not generally\navailable yet.\n\nA malicious actor who gets the code before the client uses it can try to exchange it for tokens. If the client\nuses a client secret or PKCE, the actor also needs that secret or the PKCE code verifier."
|
|
586
|
+
title = 'GitLab IAM OAuth authorization code'
|
|
587
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nIf you think someone used the code, revoke the OAuth authorization of the application:\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Applications**.\n1. In the **Authorized applications** section, by the application, select **Revoke**.\n\nThis also revokes the tokens that the IAM service issued to that application for you.\n\nFor more information, see\n[View all authorized applications](https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications)."
|
|
588
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
589
|
+
keywords = ['gliamac-']
|
|
590
|
+
|
|
591
|
+
[[rules]]
|
|
592
|
+
id = 'gitlab_feed_token_path_dependent'
|
|
593
|
+
regex = '\b(?:[a-zA-Z0-9]{1,20}-)?glft-[0-9a-f]{64}-[0-9]{1,20}\b'
|
|
594
|
+
description = "A GitLab path-dependent feed token was identified. The token starts with `glft-`, followed by 64 hexadecimal\ncharacters, a hyphen, and a user ID. GitLab puts this token in feed URLs, for example RSS, Atom, and calendar URLs. The\ntoken is valid for one feed path only. GitLab makes it from the user's feed token.\n\nA malicious actor with access to this token can read the feed. A feed can show information from confidential issues."
|
|
595
|
+
title = 'GitLab path-dependent feed token'
|
|
596
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nReset the feed token of the user. This also makes all path-dependent feed tokens of that user invalid.\n\n1. In the upper-right corner, select your avatar.\n1. Select **Edit profile**.\n1. In the left sidebar, select **Access** > **Personal access tokens**.\n1. Scroll down. In the **Feed token** section, select the **reset this token** link.\n1. On the confirmation dialog, select **OK**.\n\nFor more information, see\n[Reset the user activity feed token](https://docs.gitlab.com/user/profile/contributions_calendar/#reset-the-user-activity-feed-token)."
|
|
597
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
598
|
+
keywords = ['glft-']
|
|
599
|
+
|
|
600
|
+
[[rules]]
|
|
601
|
+
id = 'gitlab_pipeline_trigger_token_in_url'
|
|
602
|
+
regex = '/trigger/pipeline\?(?:[0-9a-zA-Z_.%\[\]=-]{1,100}&){0,10}token=([0-9a-f]{30})\b'
|
|
603
|
+
description = "A GitLab pipeline trigger token was identified in a pipeline trigger URL. This rule finds trigger tokens\nthat GitLab created before it added the `glptt-` prefix. These tokens are 30 hexadecimal characters. Trigger tokens\nexpire only if an expiry date was set.\n\nA malicious actor with access to this token can run pipelines for a branch or tag of the project, with custom\nvariables."
|
|
604
|
+
title = 'GitLab pipeline trigger token in a trigger URL'
|
|
605
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a pipeline trigger token:\n\n1. In the top bar, select **Search or go to** and find your project.\n1. In the left sidebar, select **Settings** > **CI/CD**.\n1. Expand **Pipeline trigger tokens**.\n1. In the row of the identified token, in the **Actions** column, select **Revoke trigger** (remove icon).\n1. In the confirmation dialog, select **Revoke trigger**.\n\nFor more information, see\n[Revoke a pipeline trigger token](https://docs.gitlab.com/ci/triggers/#revoke-a-pipeline-trigger-token)."
|
|
606
|
+
tags = ['gitlab', 'gitlab_blocking']
|
|
607
|
+
keywords = ['/trigger/pipeline?']
|
|
608
|
+
|
|
479
609
|
[[rules]]
|
|
480
610
|
id = 'GrafanaCloudAccessPolicyToken'
|
|
481
611
|
regex = "\\b(glc_eyJvIjoi[A-Za-z0-9+\\/]{80,220}={0,2})(?:\\\\['\"rn]|['\"\\x60; \\s]|<\\/|$)"
|
|
@@ -571,7 +701,7 @@ id = 'Intercom API token'
|
|
|
571
701
|
regex = '\bdG9rO(?:[0-9A-Za-z]{55}\b|[0-9A-Za-z]{54}=|[0-9A-Za-z]{53}==)'
|
|
572
702
|
description = "An Intercom API Token was detected. These tokens provide direct API access to your Intercom workspace and can\nbe either personal access tokens or app-level access tokens. A malicious actor with access to this token could\nread customer conversations, access user data, send messages, modify workspace settings, and perform other\nactions based on the token's permission scope."
|
|
573
703
|
title = 'Intercom API Token'
|
|
574
|
-
remediation = "For general guidance on handling security incidents with
|
|
704
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab\ndocumentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke your Intercom API Token:\n\n1. Log in to your [Intercom workspace](https://app.intercom.com/)\n2. Navigate to Settings by clicking the gear icon in the bottom-left corner\n3. Select \"Developers\" from the settings menu, then choose \"Developer Hub\"\n4. Click on \"Your Apps\" and select the app associated with the compromised token\n5. In the \"Authentication\" section, locate the access token that was compromised\n6. Click \"Revoke\" next to the compromised token to immediately invalidate it\n7. Generate a new access token by clicking \"Create access token\" or \"New access token\"\n8. Update all applications, services, and integrations with the new token\n9. Test API calls to verify the new token works correctly and the old token is invalid\n\nFor detailed information on managing Intercom API tokens, please see the\n[Intercom API Authentication Documentation](https://developers.intercom.com/docs/build-an-integration/learn-more/authentication/)."
|
|
575
705
|
tags = ['gitlab_blocking']
|
|
576
706
|
keywords = ['dG9rO']
|
|
577
707
|
|
|
@@ -848,9 +978,9 @@ keywords = ['xsmtpsib-']
|
|
|
848
978
|
[[rules]]
|
|
849
979
|
id = 'Shippo API token'
|
|
850
980
|
regex = '\bshippo_live_[a-f0-9]{40}\b'
|
|
851
|
-
description = "A live Shippo API token
|
|
981
|
+
description = "A live Shippo API token. API tokens can be used to access the Shippo API which is used for shipping services.\nA malicious actor with access to this token can access billing and order information and modify shipping data."
|
|
852
982
|
title = 'Shippo API token'
|
|
853
|
-
remediation = "For general guidance on handling security incidents with
|
|
983
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an API token:\n\n- Sign in to your Shippo account and access <https://apps.goshippo.com/>\n- In the top right-hand side, select the \"gear\" icon to go to the \"Settings\" page\n- Scroll down in the left hand menu to \"Advanced\" and select \"API\"\n- Under the \"Token\" section, select \"Manage your token\"\n- Find the identified token and select the trash icon\n- When prompted, select \"Yes, remove token\" in the \"Manage Your Tokens\" dialog\n\nFor more information, see [Shippo documentation on API keys](https://portal.goshippo.com/api-config/api)."
|
|
854
984
|
tags = ['gitlab_blocking']
|
|
855
985
|
keywords = ['shippo_live_']
|
|
856
986
|
|
|
@@ -866,9 +996,9 @@ keywords = ['shpss_']
|
|
|
866
996
|
[[rules]]
|
|
867
997
|
id = 'Shopify access token'
|
|
868
998
|
regex = 'shpat_[a-fA-F0-9]{32}'
|
|
869
|
-
description = "A Shopify personal access token
|
|
999
|
+
description = "A Shopify personal access token. Access tokens can be given\nrestricted scopes or be given full access to all store data. A malicious actor with\naccess to this token could be able to read or modify store data."
|
|
870
1000
|
title = 'Shopify personal access token'
|
|
871
|
-
remediation = "For general guidance on handling security incidents with
|
|
1001
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nAccess tokens cannot be revoked. You must uninstall and reinstall the application.\n\nSee [Shopify documentation for more details](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/generate-app-access-tokens-admin#rotating-api-credentials-for-admin-created-apps)."
|
|
872
1002
|
tags = ['gitlab_blocking']
|
|
873
1003
|
keywords = ['shpat_']
|
|
874
1004
|
|
|
@@ -902,9 +1032,9 @@ keywords = ['prtapi_']
|
|
|
902
1032
|
[[rules]]
|
|
903
1033
|
id = 'Slack token'
|
|
904
1034
|
regex = 'xox[baprs]-([0-9a-zA-Z]{10,48})'
|
|
905
|
-
description = "A Slack bot user OAuth token
|
|
1035
|
+
description = "A Slack bot user OAuth token. A Slack app's capabilities and permissions are governed by the scopes it\nrequests. A full list of permissions can be found [in Slack scopes documentation](https://api.slack.com/scopes).\nA malicious actor with access to this token can execute functionality that was assigned to it."
|
|
906
1036
|
title = 'Slack bot user OAuth token'
|
|
907
|
-
remediation = "For general guidance on handling security incidents with
|
|
1037
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a Slack bot user OAuth token (Note: This requires all users to re-authorize your application):\n\n- Sign in to Slack and access <https://api.slack.com/apps>\n- Find the application with the identified token and select the name\n- In the left-hand menu, select \"OAuth & Permissions\"\n- Scroll down to \"Revoke All OAuth Tokens\" and select \"Revoke tokens\"\n- When prompted, select \"Yes, I'm sure\" in the \"Are you sure?\" dialog\n- After some time, scroll back up to the \"OAuth Tokens\" section and select \"Reinstall to XXX\", where XXX is your\n workspace name\n\nFor more information, see [Slack documentation on OAuth](https://api.slack.com/authentication/oauth-v2)"
|
|
908
1038
|
tags = ['gitlab_blocking']
|
|
909
1039
|
keywords = ['xoxb', 'xoxa', 'xoxp', 'xoxr', 'xoxs']
|
|
910
1040
|
|
|
@@ -974,9 +1104,9 @@ keywords = ['eyJraWQiOiJzcGx1bmsuc2VjcmV0']
|
|
|
974
1104
|
[[rules]]
|
|
975
1105
|
id = 'StripeLiveSecretKey'
|
|
976
1106
|
regex = '\bsk_live_[A-Za-z0-9]{99}\b'
|
|
977
|
-
description = "A Stripe live secret key
|
|
1107
|
+
description = "A Stripe live secret key. Live secret keys authenticate requests on your server when in\nlive mode. By default, you can use this key to perform any API request without restriction. A malicious actor with\naccess to this key could gain read/write access to all data in Stripe for this account."
|
|
978
1108
|
title = 'Stripe live secret key'
|
|
979
|
-
remediation = "For general guidance on handling security incidents with
|
|
1109
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your Stripe live secret key:\n\n- Sign in to your Stripe account and access <https://dashboard.stripe.com/apikeys>\n- Ensure \"Test mode\" is disabled\n- In the \"Standard keys\" section, find the key that was identified and select the ellipsis in the right-hand side\n- Select \"Roll key...\"\n- In the \"Roll API key\" dialog, select an expiration date, for example \"now\"\n- Select \"Roll API Key\"\n\nFor more information, see [Stripe documentation on rotating API keys](https://docs.stripe.com/keys#rolling-keys)."
|
|
980
1110
|
tags = ['gitlab_blocking']
|
|
981
1111
|
keywords = ['sk_live_']
|
|
982
1112
|
|
|
@@ -992,7 +1122,7 @@ keywords = ['rk_live_']
|
|
|
992
1122
|
[[rules]]
|
|
993
1123
|
id = 'StripeLiveShortSecretKey'
|
|
994
1124
|
regex = '\bsk_live_[A-Za-z0-9]{24}\b'
|
|
995
|
-
description = "A Stripe live secret key was identified. Live secret keys authenticate requests on your server when in\nlive mode. By default, you can use this key to perform any API request without restriction. A malicious actor
|
|
1125
|
+
description = "A Stripe live secret key was identified. Live secret keys authenticate requests on your server when in\nlive mode. By default, you can use this key to perform any API request without restriction. A malicious actor with\naccess to this key could gain read/write access to all data in Stripe for this account."
|
|
996
1126
|
title = 'Stripe live secret key'
|
|
997
1127
|
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your Stripe live secret key:\n\n- Sign in to your Stripe account and access <https://dashboard.stripe.com/apikeys>\n- Ensure \"Test mode\" is disabled\n- In the \"Standard keys\" section, find the key that was identified and select the ellipsis in the right-hand side\n- Select \"Roll key...\"\n- In the \"Roll API key\" dialog, select an expiration date, for example \"now\"\n- Select \"Roll API Key\"\n\nFor more information, please see [Stripe's documentation on rotating API keys](https://docs.stripe.com/keys#rolling-keys)."
|
|
998
1128
|
tags = ['gitlab_blocking']
|
|
@@ -1075,6 +1205,6 @@ id = 'Yandex.Cloud API Key'
|
|
|
1075
1205
|
regex = '\bAQVN[0123wxyz][0-9A-Za-z_-]{35}\b'
|
|
1076
1206
|
description = 'Yandex.Cloud API Key'
|
|
1077
1207
|
title = 'Yandex.Cloud API Key'
|
|
1078
|
-
remediation = "For general guidance on handling security incidents with
|
|
1208
|
+
remediation = "For general guidance on handling security incidents with regard to leaked keys, see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
|
|
1079
1209
|
tags = ['gitlab_blocking']
|
|
1080
1210
|
keywords = ['AQVN']
|
|
@@ -5,7 +5,7 @@ module Gitlab
|
|
|
5
5
|
class Gem
|
|
6
6
|
# Ensure to maintain the same version in CHANGELOG file.
|
|
7
7
|
# More details available under 'Release Process' section in the README.md file.
|
|
8
|
-
VERSION = "0.
|
|
8
|
+
VERSION = "0.47.0"
|
|
9
9
|
|
|
10
10
|
# SD_ENV env var is used to determine which environment the
|
|
11
11
|
# server is running. This var is defined in `.runway/env-<env>.yml` files.
|
metadata
CHANGED
|
@@ -1,16 +1,15 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: gitlab-secret_detection
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.47.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- group::secret detection
|
|
8
8
|
- Stan Hu
|
|
9
9
|
- gitlab_rubygems
|
|
10
|
-
autorequire:
|
|
11
10
|
bindir: bin
|
|
12
11
|
cert_chain: []
|
|
13
|
-
date:
|
|
12
|
+
date: 1980-01-02 00:00:00.000000000 Z
|
|
14
13
|
dependencies:
|
|
15
14
|
- !ruby/object:Gem::Dependency
|
|
16
15
|
name: grpc
|
|
@@ -314,7 +313,6 @@ metadata:
|
|
|
314
313
|
homepage_uri: https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-service
|
|
315
314
|
source_code_uri: https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-service
|
|
316
315
|
changelog_uri: https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-service/-/blob/main/CHANGELOG.md
|
|
317
|
-
post_install_message:
|
|
318
316
|
rdoc_options: []
|
|
319
317
|
require_paths:
|
|
320
318
|
- lib
|
|
@@ -329,8 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
329
327
|
- !ruby/object:Gem::Version
|
|
330
328
|
version: '0'
|
|
331
329
|
requirements: []
|
|
332
|
-
rubygems_version: 3.
|
|
333
|
-
signing_key:
|
|
330
|
+
rubygems_version: 3.6.9
|
|
334
331
|
specification_version: 4
|
|
335
332
|
summary: GitLab Secret Detection gem scans for the secret leaks in the given text-based
|
|
336
333
|
payloads.
|