Azure Entra ID Token detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_300
Category	Secrets
Severity	MEDIUM
Framework	Git

Impact

The Azure Entra ID Token (OAuth or Actor token) is an identity credential for the entire Microsoft 365/Azure tenant.

Compromise is an Extremely Critical Risk that can bypass MFA, Conditional Access, and logging, allowing an attacker to impersonate any user (including Global Administrators) across the entire tenant, leading to a massive infrastructure takeover.

How to Fix

To remediate exposed Auth tokens or Signing Keys:

1. Log in to your Identity Provider or OAuth provider settings.
2. Rotate the compromised Client Secret, Private Key, or Signing Certificate.
3. Update your application configuration with the new credentials.
4. Redeploy your application to ensure the new keys are in effect.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.

Warning: Rotating signing keys or client secrets will likely invalidate active user sessions or tokens. Be prepared for users to be logged out.