GitHub repository webhook defined in Terraform does not use a secure SSL misconfiguration detected i

GitHub repository webhook defined in Terraform does not use a secure SSL misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GIT_2
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	Terraform

Impact

GitHub repository webhooks allow you to build or set up integrations that subscribe to certain events on GitHub. When configuring webhooks, it's crucial to ensure the security of communications between GitHub and the server that handles the webhook requests. Using HTTPS is a way to secure these communications.

A webhook set up with insecure SSL (insecure_ssl set to true) can expose sensitive data to potential man-in-the-middle attacks, as the data transmission is not encrypted.

How to Fix

Ensure that the webhook resource in your Terraform configuration is set to use HTTPS and that SSL verification is not disabled. [source,go]

resource "github_repository_webhook" "example" { repository = "example-repo"

configuration { url = "https://.com/path" content_type = "json"

• insecure_ssl = false

... other configuration ...

}

... other parameters ...

}