Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [environment-variables]

The tag has no usage guidance.

1
vote
0answers
28 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
7
votes
1answer
113 views

Is it unsafe to use environmental variables for secret data?

After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application. His primary ...
0
votes
0answers
27 views

How and in what scopes can Linux Environment Variables be secured? [duplicate]

I read an interesting article about securely inputing secret info into a command using pass (a wrapper for GnuPG) and environment variables in Linux; but in order to do this one needs to use ...
3
votes
0answers
36 views

Are environmental variables for web PaaS a bad security smell?

I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis Assuming this has been done to follow good ...
1
vote
2answers
374 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
2
votes
1answer
500 views

Why is the setuid bit not working when I execute this binary?

I am currently going through the Narnia challenges on overthewire.org. For the 1-->2 challenge, I am running into an issue that I can't seem to get around. Basically there is a C program called ...
2
votes
0answers
85 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
1
vote
0answers
43 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
1
vote
0answers
105 views

Password as environment variable- is it a good idea? [duplicate]

Is it possible in Unix/Linux to access environment variable from another sessions. For instance export MYPASSWORD = 'MySecretPassword" would it be possible by another user on the same machine to ...
1
vote
1answer
140 views

How to handle sensitive data like API-keys and DB passwords on production

I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
2
votes
0answers
66 views

Node.js ENV VAR Security

Recently I had a debate with a fellow dev about where to store Node.js env vars. I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
2
votes
0answers
33 views

Is there anything inherently insecure in setting a custom environment variable to a request parameter?

Imagine I have the following rails endpoint: def configure_welcome_message ENV['myapp_welcome_message'] = params[:welcome_message] end Aside from the fact that this is an inane way to set a ...
10
votes
1answer
2k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
5
votes
2answers
2k views

How to securely store secrets in Docker container?

The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
1
vote
2answers
435 views

ENV exports in docker entry_point.sh that is ran from CI

Assuming I have the following line in Django settings: OKPAY_API_KEY = os.environ.get('Ok_PAY_API_KEY') Then import it to my build process in wercker CI And then write this var to the entrypoint....
3
votes
3answers
390 views

Plain text Rails environment variables and security

I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "...
20
votes
3answers
3k views

Some folders in the PATH variable are writable by anyone. Dangerous or not?

I noticed that some folders in the PATH environment variable (e.g. C:\Python) give write privileges to anyone on the machine, including users without Admin rights. I understand that people can ...
0
votes
2answers
37 views

Can environment variables created for a unix account be viewable by another account?

If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
1
vote
2answers
84 views

What sort of attacks could be performed by an attacker who can set environment variables? [closed]

If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?
2
votes
1answer
817 views

What's the motivation for excluing /usr/local/bin from root's PATH?

I just discovered that root's PATH on CentOS does not include /usr/local/bin. What's the rationale for this? I'm tempted to add it to the PATH but I don't know what vulnerabilities that might ...
4
votes
2answers
610 views

Azure Key Vault vs Azure Environment Variables - Which is the right way?

I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
4
votes
1answer
1k views

What are some vulnerabilities of environment variables (on any platform)?

I am writing a small cross platform Python application (a package manager to be used internally by my corp), and I'm thinking of using something similar to this answer on Stack Overflow to check for ...
6
votes
1answer
2k views

Ordering of the PATH environment variable

Locally here on Ubuntu 14.04, my $PATH looks something like this: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" When I manually define the path for ...