mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-02 08:43:27 +08:00
72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
id: gcloud-api-key-unrestricted
|
|
|
|
info:
|
|
name: Unrestricted API Key Usage
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
Ensure that the use of Google Cloud API keys is limited to trusted and reliable hosts, HTTP referrers, or applications. An API key application restriction manages the authorization of websites, IP addresses, or Android/iOS mobile applications that can employ your API key. It is crucial that all API keys used in production employ host and application restrictions. By enforcing these restrictions, you can reduce the impact that a compromised API key can have on your applications.
|
|
impact: |
|
|
API keys without restrictions can be used unrestrictedly, which might lead to unauthorized access and misuse, potentially exposing sensitive data or services.
|
|
remediation: |
|
|
Apply restrictions to all production API keys to specify the allowed websites, IP addresses, or mobile applications that can use each key, to mitigate potential abuse.
|
|
reference:
|
|
- https://cloud.google.com/docs/authentication/api-keys#restricting_api_keys
|
|
tags: cloud,devops,gcp,gcloud,api-keys,gcp-cloud-config
|
|
|
|
flow: |
|
|
code(1)
|
|
for(let projectId of iterate(template.projectIds)){
|
|
set("projectId", projectId)
|
|
code(2)
|
|
for(let uid of iterate(template.uids)){
|
|
set("uid", uid)
|
|
code(3)
|
|
}
|
|
}
|
|
|
|
self-contained: true
|
|
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
gcloud projects list --format="json(projectId)"
|
|
|
|
extractors:
|
|
- type: json
|
|
name: projectIds
|
|
internal: true
|
|
json:
|
|
- '.[].projectId'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
gcloud alpha services api-keys list --project $projectId --format="json(uid)"
|
|
|
|
extractors:
|
|
- type: json
|
|
name: uids
|
|
internal: true
|
|
json:
|
|
- '.[].uid'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
gcloud alpha services api-keys describe $uid --format="json(restrictions)"
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'null'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"Unrestricted API Key: " + uid + " in Project: " + projectId'
|
|
# digest: 4a0a00473045022100d1751d133cbe1cb508355fb6acc6fb0d51094a8c42db864114772bfce2fd382a022022cb36fbfcf3f8b8ef22cd8a428104f85035cc421437b2e735f221396b39c224:922c64590222798bb761d5b6d8e72950 |