Operation Objects Uses Basic Auth misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_15
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

This rule is checking for operation objects in OpenAPI version 2.0 files that are using basic authentication. Basic authentication is a simple authentication scheme built into the HTTP protocol, and involves sending user credentials (username and password) in the headers of a request. It's generally considered insecure for several reasons. Firstly, user credentials are sent as plaintext with basic encoding, making it easy for eavesdroppers to possibly intercept and see the credentials, especially if the request is sent over an unencrypted (i.e., non-HTTPS) connection. Secondly, basic authentication makes your application vulnerable to brute force attacks, as it doesn't incorporate any functionality for limiting login attempts. Overall, using a more secure authentication method, such as token-based or OAuth 2.0 authentication, is recommended.

How to Fix

Ensure that you aren't using the unencryptedScheme. For example: components: securitySchemes:

• unencryptedScheme:
•  type: http

•  scheme: basic

paths: "/": get: security:

•    - unencryptedScheme: []

---