60 lines
1.8 KiB
Plaintext
60 lines
1.8 KiB
Plaintext
|
include::../../../shared_content/secrets/description.adoc[]
|
||
|
|
|
||
|
|
== Why is this an issue?
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/rationale.adoc[]
|
||
|
|
|
||
|
|
If an attacker gains access to a DigitalOcean personal access token or OAuth token, they might be able to compromise your DigitalOcean environment. This includes control over Droplets and any applications that are running, as well as databases and other assets that are managed by the account.
|
||
|
|
|
||
|
|
=== What is the potential impact?
|
||
|
|
|
||
|
|
If an attacker manages to gain access to the DigitalOcean environment, there exist several ways that they could seriously harm your organization. Any data that is stored in the environment could be leaked, but the environment itself could even be tampered with.
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/impact/data_compromise.adoc[]
|
||
|
|
|
||
|
|
:service_name: DigitalOcean
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/impact/infrastructure_takeover.adoc[]
|
||
|
|
|
||
|
|
== How to fix it
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/fix/revoke.adoc[]
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/fix/vault.adoc[]
|
||
|
|
|
||
|
|
=== Code examples
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
[source,ruby,diff-id=1,diff-type=noncompliant]
|
||
|
|
----
|
||
|
|
require 'droplet_kit'
|
||
|
|
|
||
|
|
token = 'dop_v1_1adc4095c3c676ff1c31789a1a86480195a5b3d955010c94fcfa554b34640e1e' # Noncompliant
|
||
|
|
client = DropletKit::Client.new(access_token: token)
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant solution
|
||
|
|
|
||
|
|
[source,ruby,diff-id=1,diff-type=compliant]
|
||
|
|
----
|
||
|
|
require 'droplet_kit'
|
||
|
|
|
||
|
|
token = ENV['DIGITALOCEAN_TOKEN']
|
||
|
|
client = DropletKit::Client.new(access_token: token)
|
||
|
|
----
|
||
|
|
|
||
|
|
//=== How does this work?
|
||
|
|
|
||
|
|
//=== Pitfalls
|
||
|
|
|
||
|
|
//=== Going the extra mile
|
||
|
|
|
||
|
|
== Resources
|
||
|
|
|
||
|
|
=== Documentation
|
||
|
|
|
||
|
|
DigitalOcean Documentation - https://docs.digitalocean.com/reference/api/create-personal-access-token/[How to Create a Personal Access Token]
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/resources/standards.adoc[]
|