Questions tagged [environment-variables]
The environment-variables tag has no usage guidance.
43 questions
0
votes
1
answer
124
views
how to protect a string (secret key) in my env file in node.js project?
I have a node.js project which implement in nest.js framework.
there is some apiKey and secretKey in my env file, I want to protect these keys from anyone, even host administrator. so I compile my ...
- 101
1
vote
1
answer
48
views
Passing credentials in GNU Make
I don't make it a habit to pass credentials in scripts, but i'm in the process of automating some setup of my routers and using GNU make to have a simple make command to fix everything for me.
However,...
- 23
1
vote
1
answer
224
views
Storing TOTP keys
I am working on a application which requires session token to commence trading activities. This will be hosted on a cloud based Linux VM (Ubuntu) and a managed MySQL database.
Session token are ...
- 111
0
votes
1
answer
203
views
Launch a process with secrets as environment variables
I have a process that needs secret keys to be passed as environment variables. That is for historical reasons.
I have a AWS machine where this process runs but I do not want to store these keys in ...
- 103
1
vote
0
answers
550
views
I do not understand how the standard practice to pass secrets as environment variables to containers considered as safe? [duplicate]
TL;DR
The container's environment variable can be queried many ways, with native docker tools or 3rd party tools. The docker admin user (or any user in the docker group) not necessary dba on a ...
- 230
0
votes
0
answers
89
views
Which system variables are exposed from browser JavaScript context?
I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting.
What are the exposed variables to browser's ?
- 101
0
votes
1
answer
288
views
Exporting shellcode to environment variable doesn't work as expected
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )
When exporting shellcode to EGG environment variable
export ...
0
votes
1
answer
183
views
Secret security in containerised environment
I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps.
Background ...
- 123
1
vote
1
answer
105
views
Securely loading private tokens on a local machine
When doing local development, I have to export a token needed for downloading dependencies from a private repository. For example:
export NPM_TOKEN=token_value
I want to make sure that this token is ...
- 11
1
vote
1
answer
349
views
Details: snoop environment variables using D-Bus IPC
The page at: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment says:
Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC [...]
I don't ...
- 111
2
votes
1
answer
711
views
Why are environment variables safe after 2022 Heroku breach?
In their communication about the april 2022 breach (summary here), Heroku states that environment variables (other than Review apps and CI variables) were safe because they are encrypted at rest.
We ...
1
vote
0
answers
546
views
Can modifying environment variables in Windows cause vulnerability?
As normal user, if you open the Edit Environment Variable setting in Windows, you will get this:
As you can see, the %path% variable that available for an user is a combination of %path% set globally ...
- 111
2
votes
1
answer
147
views
ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?
I was browsing the ld.so man page and I saw an entry about Secure-Execution mode:
**Secure-execution mode**
For security reasons, if the dynamic linker determines that a binary
should ...
- 21
2
votes
1
answer
2k
views
SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf
Background
Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes.
I ...
- 375
2
votes
1
answer
1k
views
How to globally enable ld.so secure-execution mode for all applications?
Quote https://manpages.debian.org/buster/manpages/ld.so.8.en.html#Secure-execution_mode
Secure-execution mode
For security reasons, the effects of some environment variables are voided or modified if ...
- 784
1
vote
0
answers
1k
views
Digital Ocean ENV Variables - .env file, ENV Variables, or something else
Does Digital Ocean have something similar to Credstash or AWS Secrets Manager (both AWS services)?
Trying to decide on the most secure way to store environmental variables with sensitive information (...
- 111
1
vote
1
answer
923
views
Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)
Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
- 143
1
vote
1
answer
1k
views
Handling secrets and environmental variables in Docker-k8s-skaffold dev environment
Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it.
Just ...
- 223
1
vote
1
answer
203
views
Securing Code Secrets - What is the relevance if the host gets compromised?
I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
- 145
48
votes
10
answers
20k
views
Global variables and information security
I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. ...
user123574
0
votes
1
answer
808
views
Storing server-side secret key in environment variable - is a concern?
Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
- 374
1
vote
0
answers
197
views
Trust boundaries for webapps (vs desktop apps)
I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.
In some cases, our ...
- 117
40
votes
2
answers
29k
views
Is it unsafe to use environmental variables for secret data?
After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application.
His primary ...
3
votes
0
answers
127
views
Are environmental variables for web PaaS a bad security smell?
I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis
Assuming this has been done to follow good ...
- 319
1
vote
2
answers
3k
views
Shellcode does not execute as the owner
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia)
Here is the source code of the vulnerable script "narnia1" I intend to exploit:
#include <stdio.h>
int ...
- 11
2
votes
1
answer
2k
views
Why is the setuid bit not working when I execute this binary?
I am currently going through the Narnia challenges on overthewire.org. For the 1-->2 challenge, I am running into an issue that I can't seem to get around. Basically there is a C program called ...
- 21
2
votes
0
answers
344
views
Is it safe to retrieve GnuPG public/secret key with fs in Node.js?
So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
- 223
2
votes
0
answers
225
views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
- 1,092
1
vote
0
answers
2k
views
Password as environment variable- is it a good idea? [duplicate]
Is it possible in Unix/Linux to access environment variable from another sessions. For instance
export MYPASSWORD = 'MySecretPassword"
would it be possible by another user on the same machine to ...
- 422
1
vote
1
answer
711
views
How to handle sensitive data like API-keys and DB passwords on production
I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
- 115
2
votes
0
answers
176
views
Node.js ENV VAR Security
Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
- 2,859
2
votes
0
answers
144
views
Is there anything inherently insecure in setting a custom environment variable to a request parameter?
Imagine I have the following rails endpoint:
def configure_welcome_message
ENV['myapp_welcome_message'] = params[:welcome_message]
end
Aside from the fact that this is an inane way to set a ...
Devon Parsons
21
votes
1
answer
11k
views
What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?
There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables.
In what particular ...
- 313
7
votes
3
answers
6k
views
How to securely store secrets in Docker container?
The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
- 323
1
vote
2
answers
645
views
ENV exports in docker entry_point.sh that is ran from CI
Assuming I have the following line in Django settings:
OKPAY_API_KEY = os.environ.get('Ok_PAY_API_KEY')
Then import it to my build process in wercker CI
And then write this var to the entrypoint....
- 391
3
votes
3
answers
750
views
Plain text Rails environment variables and security
I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "...
- 31
20
votes
3
answers
5k
views
Some folders in the PATH variable are writable by anyone. Dangerous or not?
I noticed that some folders in the PATH environment variable (e.g. C:\Python) give write privileges to anyone on the machine, including users without Admin rights. I understand that people can ...
- 309
0
votes
2
answers
131
views
Can environment variables created for a unix account be viewable by another account?
If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
- 133
1
vote
2
answers
292
views
What sort of attacks could be performed by an attacker who can set environment variables? [closed]
If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?
3
votes
1
answer
3k
views
What's the motivation for excluing /usr/local/bin from root's PATH?
I just discovered that root's PATH on CentOS does not include /usr/local/bin.
What's the rationale for this? I'm tempted to add it to the PATH but I don't know what vulnerabilities that might ...
- 315
7
votes
2
answers
3k
views
Azure Key Vault vs Azure Environment Variables - Which is the right way?
I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
- 381
5
votes
1
answer
6k
views
What are some vulnerabilities of environment variables (on any platform)?
I am writing a small cross platform Python application (a package manager to be used internally by my corp), and I'm thinking of using something similar to this answer on Stack Overflow to check for ...
- 51
9
votes
2
answers
11k
views
Ordering of the PATH environment variable
Locally here on Ubuntu 14.04, my $PATH looks something like this:
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"
When I manually define the path for ...
- 6,843