Security: Credentials stored in cleartext memory

[catherinevee]

Security Vulnerability Report

Summary

The current implementation stores cloud provider credentials in memory without proper sanitization, potentially exposing them in crash dumps or swap files.

Details

• Component: internal/providers/aws/provider.go
• Severity: Medium
• CVSS Score: 6.5
• CWE: CWE-316 (Cleartext Storage in Memory)

Vulnerable Code

// Current implementation
type AWSProvider struct {
    accessKey    string  // Stored in cleartext
    secretKey    string  // Stored in cleartext
    sessionToken string  // Stored in cleartext
}

Recommended Fix

// Secure implementation
type AWSProvider struct {
    credentials  *SecureString  // Encrypted in memory
}

type SecureString struct {
    encrypted []byte
    // Use runtime.SetFinalizer for cleanup
}

Impact

• Credentials could be exposed in memory dumps
• Swap files might contain sensitive data
• Debugging tools could reveal credentials

Mitigation

1. Implement secure string handling
2. Clear credentials after use
3. Disable swap for the process
4. Use mlock() to prevent paging

References

• OWASP Secure Coding Practices
• AWS Security Best Practices
• CWE-316 Documentation

Disclosure Timeline

• 2025-09-06: Issue discovered during security audit
• 2025-09-06: Reported to maintainers
• 2025-09-13: Public disclosure (7 days)

Please assign CVE if applicable.