From d6aa1d587c2e29eb44d5e0af3e5a23beb60089cf Mon Sep 17 00:00:00 2001
From: "hashicorp-vault-sonar-prod[bot]"
 <111297361+hashicorp-vault-sonar-prod[bot]@users.noreply.github.com>
Date: Wed, 17 Jul 2024 10:09:07 +0200
Subject: [PATCH] Create rule S7014: Detect Cloudera secrets (APPSEC-1852)
 (#4059)

---
 rules/S7014/metadata.json         |  2 ++
 rules/S7014/secrets/metadata.json | 56 +++++++++++++++++++++++++++++++
 rules/S7014/secrets/rule.adoc     | 52 ++++++++++++++++++++++++++++
 3 files changed, 110 insertions(+)
 create mode 100644 rules/S7014/metadata.json
 create mode 100644 rules/S7014/secrets/metadata.json
 create mode 100644 rules/S7014/secrets/rule.adoc

diff --git a/rules/S7014/metadata.json b/rules/S7014/metadata.json
new file mode 100644
index 0000000000..2c63c08510
--- /dev/null
+++ b/rules/S7014/metadata.json
@@ -0,0 +1,2 @@
+{
+}
diff --git a/rules/S7014/secrets/metadata.json b/rules/S7014/secrets/metadata.json
new file mode 100644
index 0000000000..2d0d8c5ff4
--- /dev/null
+++ b/rules/S7014/secrets/metadata.json
@@ -0,0 +1,56 @@
+{
+  "title": "Cloudera access keys should not be disclosed",
+  "type": "VULNERABILITY",
+  "code": {
+    "impacts": {
+      "SECURITY": "HIGH"
+    },
+    "attribute": "TRUSTWORTHY"
+  },
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "30min"
+  },
+  "tags": [
+    "cwe",
+    "cert"
+  ],
+  "defaultSeverity": "Blocker",
+  "ruleSpecification": "RSPEC-7014",
+  "sqKey": "S7014",
+  "scope": "All",
+  "securityStandards": {
+    "CWE": [
+      798,
+      259
+    ],
+    "OWASP": [
+      "A3"
+    ],
+    "CERT": [
+      "MSC03-J."
+    ],
+    "OWASP Top 10 2021": [
+      "A7"
+    ],
+    "PCI DSS 3.2": [
+      "6.5.10"
+    ],
+    "PCI DSS 4.0": [
+      "6.2.4"
+    ],
+    "ASVS 4.0": [
+      "2.10.4",
+      "3.5.2",
+      "6.4.1"
+    ],
+    "STIG ASD 2023-06-08": [
+      "V-222642"
+    ]
+  },
+  "defaultQualityProfiles": [
+    "Sonar way"
+  ],
+  "quickfix": "unknown"
+}
diff --git a/rules/S7014/secrets/rule.adoc b/rules/S7014/secrets/rule.adoc
new file mode 100644
index 0000000000..659074db1b
--- /dev/null
+++ b/rules/S7014/secrets/rule.adoc
@@ -0,0 +1,52 @@
+
+include::../../../shared_content/secrets/description.adoc[]
+
+== Why is this an issue?
+
+include::../../../shared_content/secrets/rationale.adoc[]
+
+=== What is the potential impact?
+
+// Optional: Give a general description of the secret and what it's used for.
+
+Below are some real-world scenarios that illustrate some impacts of an attacker
+exploiting the secret.
+
+// Set value that can be used to refer to the type of secret in, for example:
+// "An attacker can use this {secret_type} to ..."
+:secret_type: access key
+
+// Where possible, use predefined content for common impacts. This content can
+// be found in the folder "shared_content/secrets/impact".
+// When using predefined content, search for any required variables to be set and include them in this file.
+// Not adding them will not trigger warnings.
+
+include::../../../shared_content/secrets/impact/personal_data_compromise.adoc[]
+
+include::../../../shared_content/secrets/impact/financial_loss.adoc[]
+
+== How to fix it
+
+include::../../../shared_content/secrets/fix/revoke.adoc[]
+
+include::../../../shared_content/secrets/fix/vault.adoc[]
+
+=== Code examples
+
+:example_secret: motvod88m3jnpdvkci0r3934rij5z7at
+:example_name: cloudera-access-key
+:example_env: CLOUDERA_ACCESS_KEY
+
+include::../../../shared_content/secrets/examples.adoc[]
+
+//=== How does this work?
+
+//=== Pitfalls
+
+//=== Going the extra mile
+
+== Resources
+
+include::../../../shared_content/secrets/resources/standards.adoc[]
+
+//=== Benchmarks