nerdexam
Cisco

200-901 · Question #299

A developer pushes an application to production. The application receives a webhook over HTTPS without a secret. The webhook information contains credentials to service in cleartext. When the…

The correct answer is B. During the transport of webhook messages, the credentials could be unencrypted and leaked. The primary security issue is that sensitive credentials are transmitted in cleartext within the webhook message, making them vulnerable to exposure if intercepted or improperly handled, especially when debug logging is enabled and the webhook lacks a secret for authentication.

Application Deployment and Security

Question

A developer pushes an application to production. The application receives a webhook over HTTPS without a secret. The webhook information contains credentials to service in cleartext. When the information is received, it is stored in the database with an SHA-256 hash. Credentials to the database are accessed at runtime through the use of a vault service. While troubleshooting, the developer sets the logging to debug to view the message from the webhook. What is the security issue in this scenario?

Options

  • ADatabase credentials should be accessed by using environment variables defined at runtime.
  • BDuring the transport of webhook messages, the credentials could be unencrypted and leaked.
  • CDuring logging, debugging should be disabled for the webhook message.
  • DHashing the credentials in the database is not secure enough; the credentials should be

How the community answered

(43 responses)
  • A
    9% (4)
  • B
    84% (36)
  • C
    5% (2)
  • D
    2% (1)

Why each option

The primary security issue is that sensitive credentials are transmitted in cleartext within the webhook message, making them vulnerable to exposure if intercepted or improperly handled, especially when debug logging is enabled and the webhook lacks a secret for authentication.

ADatabase credentials should be accessed by using environment variables defined at runtime.

While accessing database credentials via a vault is a good practice, and environment variables are a common method, the existing use of a vault service addresses this aspect adequately for storage access, making it less of a direct security issue compared to the cleartext credentials in transport.

BDuring the transport of webhook messages, the credentials could be unencrypted and leaked.Correct

The webhook information explicitly contains credentials in cleartext, meaning they are unencrypted at the application layer during transport. Even with HTTPS protecting the connection, cleartext credentials within the payload can be exposed if the application logs them (as exacerbated by debug logging) or if an attacker gains access to the application's processing of the message, thereby leading to a leak.

CDuring logging, debugging should be disabled for the webhook message.

Disabling debug logging for webhook messages is a necessary mitigation practice, but it addresses a symptom rather than the root security issue, which is the presence of unencrypted sensitive data itself.

DHashing the credentials in the database is not secure enough; the credentials should be

Hashing credentials in a database is a standard practice for passwords; if these are service credentials requiring decryption, then simple hashing is insufficient, but the immediate and more critical issue described is the cleartext transmission, not the database storage method.

Concept tested: Insecure data transmission and sensitive data exposure

Source: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2021/A02_2021-Cryptographic_Failures/

Topics

#Webhook security#Cleartext credentials#Sensitive data handling#Application security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-901 Practice