CVE-2023-49113 Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer

2024-06-2012:39:00

CWE-312

SEC-VLab

github.com

kiuwan sast

local analyzer

plain text

confidentiality

hard-coded secrets

jar files

credentials

insightservicesconfig.properties

encryptor.properties

scan results

github account

encrypting key

cve-2023-49113

AI Score

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

The Kiuwan Local Analyzer (KLA) Java scanning application contains several
hard-coded secrets in plain text format. In some cases, this can
potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer.

The
JAR file “lib.engine/insight/optimyth-insight.jar” contains the file
“InsightServicesConfig.properties”, which has the configuration tokens
“insight.github.user” as well as “insight.github.password” prefilled
with credentials. At least the specified username corresponds to a valid
GitHub account. The
JAR file “lib.engine/insight/optimyth-insight.jar” also contains the
file “es/als/security/Encryptor.properties”, in which the key used for
encrypting the results of any performed scan.

This issue affects Kiuwan SAST: <master.1808.p685.q13371

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:kiuwan:local_analyzer:0:*:*:*:*:*:*:*"
    ],
    "vendor": "kiuwan",
    "product": "local_analyzer",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "master.1808.p685.q13371",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "affected"
  }
]