Skip to content

Commit 0c09469

Browse files
author
Security Research (r2c-argo)
committed
Merge Gitleaks rules 2024-08-20 # 00:30
1 parent 34555cd commit 0c09469

16 files changed

+91
-13
lines changed

‎generic/secrets/gitleaks/clojars-api-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)(CLOJARS_)[a-z0-9]{60}
26+
- pattern-regex: (?i)CLOJARS_[a-z0-9]{60}

‎generic/secrets/gitleaks/doppler-api-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (dp\.pt\.)(?i)[a-z0-9]{43}
26+
- pattern-regex: dp\.pt\.(?i)[a-z0-9]{43}

‎generic/secrets/gitleaks/duffel-api-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: duffel_(test|live)_(?i)[a-z0-9_\-=]{43}
26+
- pattern-regex: duffel_(?:test|live)_(?i)[a-z0-9_\-=]{43}

‎generic/secrets/gitleaks/github-app-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (ghu|ghs)_[0-9a-zA-Z]{36}
26+
- pattern-regex: (?:ghu|ghs)_[0-9a-zA-Z]{36}

‎generic/secrets/gitleaks/harness-api-key.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: ((?:pat|sat)\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{24}\.[a-zA-Z0-9]{20})
26+
- pattern-regex: (?:pat|sat)\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{24}\.[a-zA-Z0-9]{20}

‎generic/secrets/gitleaks/kubernetes-secret-with-data-after.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
rules:
2+
- id: kubernetes-secret-with-data-after
3+
message: A gitleaks kubernetes-secret-with-data-after was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
4+
languages:
5+
- regex
6+
severity: INFO
7+
metadata:
8+
likelihood: LOW
9+
impact: MEDIUM
10+
confidence: LOW
11+
category: security
12+
cwe:
13+
- "CWE-798: Use of Hard-coded Credentials"
14+
cwe2021-top25: true
15+
cwe2022-top25: true
16+
owasp:
17+
- A07:2021 - Identification and Authentication Failures
18+
references:
19+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
20+
source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
21+
subcategory:
22+
- vuln
23+
technology:
24+
- gitleaks
25+
patterns:
26+
- pattern-regex: (?i)\b((?i)(?:\bkind:.{0,10}Secret\b)(?:.|\s){0,200}?\b(?:data:)\s*(.+))(?:['|\"|\n|\r|\s|\x60|;]|$)

‎generic/secrets/gitleaks/kubernetes-secret-with-data-before.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
rules:
2+
- id: kubernetes-secret-with-data-before
3+
message: A gitleaks kubernetes-secret-with-data-before was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
4+
languages:
5+
- regex
6+
severity: INFO
7+
metadata:
8+
likelihood: LOW
9+
impact: MEDIUM
10+
confidence: LOW
11+
category: security
12+
cwe:
13+
- "CWE-798: Use of Hard-coded Credentials"
14+
cwe2021-top25: true
15+
cwe2022-top25: true
16+
owasp:
17+
- A07:2021 - Identification and Authentication Failures
18+
references:
19+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
20+
source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
21+
subcategory:
22+
- vuln
23+
technology:
24+
- gitleaks
25+
patterns:
26+
- pattern-regex: (?i)\b((?i)(?:\b(?:data:))(\W+(?:\w+\W+){0,200}?)\bkind:.{0,10}Secret\b)(?:['|\"|\n|\r|\s|\x60|;]|$)

‎generic/secrets/gitleaks/openshift-user-token.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
rules:
2+
- id: openshift-user-token
3+
message: A gitleaks openshift-user-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
4+
languages:
5+
- regex
6+
severity: INFO
7+
metadata:
8+
likelihood: LOW
9+
impact: MEDIUM
10+
confidence: LOW
11+
category: security
12+
cwe:
13+
- "CWE-798: Use of Hard-coded Credentials"
14+
cwe2021-top25: true
15+
cwe2022-top25: true
16+
owasp:
17+
- A07:2021 - Identification and Authentication Failures
18+
references:
19+
- https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
20+
source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
21+
subcategory:
22+
- vuln
23+
technology:
24+
- gitleaks
25+
patterns:
26+
- pattern-regex: \b(sha256~[\w-]{43})(?:[^\w-]|\z)

‎generic/secrets/gitleaks/private-key.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY( BLOCK)?-----[\s\S-]*KEY( BLOCK)?----
26+
- pattern-regex: (?i)-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\s\S-]*KEY(?: BLOCK)?----

‎generic/secrets/gitleaks/sidekiq-sensitive-url.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)\b(http(?:s??):\/\/)([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\/|\#|\?|:]|$)
26+
- pattern-regex: (?i)\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\/|\#|\?|:]|$)

‎generic/secrets/gitleaks/slack-app-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)(xapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+)
26+
- pattern-regex: (?i)xapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+

‎generic/secrets/gitleaks/slack-config-access-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)(xoxe.xox[bp]-\d-[A-Z0-9]{163,166})
26+
- pattern-regex: (?i)xoxe.xox[bp]-\d-[A-Z0-9]{163,166}

‎generic/secrets/gitleaks/slack-config-refresh-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i)(xoxe-\d-[A-Z0-9]{146})
26+
- pattern-regex: (?i)xoxe-\d-[A-Z0-9]{146}

‎generic/secrets/gitleaks/slack-legacy-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (xox[os]-\d+-\d+-\d+-[a-fA-F\d]+)
26+
- pattern-regex: xox[os]-\d+-\d+-\d+-[a-fA-F\d]+

‎generic/secrets/gitleaks/slack-user-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34})
26+
- pattern-regex: xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34}

‎generic/secrets/gitleaks/telegram-bot-api-token.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ rules:
2323
technology:
2424
- gitleaks
2525
patterns:
26-
- pattern-regex: (?i:(?:telegr)(?:[0-9a-z\(-_\t .\\]{0,40})(?:[\s|']|[\s|"]){0,3})(?:=|\|\|:|<=|=>|:|\?=|\()(?:'|\"|\s|=|\x60){0,5}([0-9]{5,16}:A[a-z0-9_\-]{34})(?:['|\"|\n|\r|\s|\x60|;|\\]|$)
26+
- pattern-regex: (?i:telegr(?:[0-9a-z\(-_\t .\\]{0,40})(?:[\s|']|[\s|"]){0,3})(?:=|\|\|:|<=|=>|:|\?=|\()(?:'|\"|\s|=|\x60){0,5}([0-9]{5,16}:A[a-z0-9_\-]{34})(?:['|\"|\n|\r|\s|\x60|;|\\]|$)

0 commit comments

Comments
 (0)