Alexa Skill Plaintext Client Secret Exposed
- Query id: 3c3b7a58-b018-4d07-9444-d9ee7156e111
- Query name: Alexa Skill Plaintext Client Secret Exposed
- Platform: CloudFormation
- Severity: Medium
- Category: Encryption
- CWE: 256
- URL: Github
Description¶
Alexa skills' client secrets should not be defined as a plaintext string. It should either use 'AWS Systems Manager Parameter Store' or 'AWS Secrets Manager' to retrieve sensitive information
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - yaml file
Resources:
MySkill:
Type: "Alexa::ASK::Skill"
Properties:
SkillPackage:
S3Bucket: "my-skill-packages"
S3Key: "skillpackage.zip"
S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
Overrides:
Manifest:
apis:
custom:
endpoint:
uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
AuthenticationConfiguration:
ClientId: "amzn1.application-oa2-client.1234"
ClientSecret: "1234"
RefreshToken: "Atzr|1234"
VendorId: "1234"
Positive test num. 2 - json file
{
"Resources": {
"MySkill": {
"Type": "Alexa::ASK::Skill",
"Properties": {
"SkillPackage": {
"S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill",
"Overrides": {
"Manifest": {
"apis": {
"custom": {
"endpoint": {
"uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill"
}
}
}
}
},
"S3Bucket": "my-skill-packages",
"S3Key": "skillpackage.zip"
},
"AuthenticationConfiguration": {
"ClientId": "amzn1.application-oa2-client.1234",
"ClientSecret": "1234",
"RefreshToken": "Atzr|1234"
},
"VendorId": "1234"
}
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
Resources:
MySkill:
Type: "Alexa::ASK::Skill"
Properties:
SkillPackage:
S3Bucket: "my-skill-packages"
S3Key: "skillpackage.zip"
S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
Overrides:
Manifest:
apis:
custom:
endpoint:
uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
AuthenticationConfiguration:
ClientId: "amzn1.application-oa2-client.1234"
ClientSecret: "{{resolve:secretsmanager:123456}}"
RefreshToken: "Atzr|1234"
VendorId: "1234"
MySkill2:
Type: "Alexa::ASK::Skill"
Properties:
SkillPackage:
S3Bucket: "my-skill-packages"
S3Key: "skillpackage.zip"
S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
Overrides:
Manifest:
apis:
custom:
endpoint:
uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill
AuthenticationConfiguration:
ClientId: "amzn1.application-oa2-client.1234"
ClientSecret: "{{resolve:ssm-secure:123456}}"
RefreshToken: "Atzr|1234"
VendorId: "1234"
# trigger validation
Negative test num. 2 - json file
{
"Resources": {
"MySkill": {
"Type": "Alexa::ASK::Skill",
"Properties": {
"SkillPackage": {
"S3Bucket": "my-skill-packages",
"S3Key": "skillpackage.zip",
"S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill",
"Overrides": {
"Manifest": {
"apis": {
"custom": {
"endpoint": {
"uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill"
}
}
}
}
}
},
"AuthenticationConfiguration": {
"ClientId": "amzn1.application-oa2-client.1234",
"ClientSecret": "{{resolve:secretsmanager:123456}}",
"RefreshToken": "Atzr|1234"
},
"VendorId": "1234"
}
},
"MySkill2": {
"Type": "Alexa::ASK::Skill",
"Properties": {
"SkillPackage": {
"S3Bucket": "my-skill-packages",
"S3Key": "skillpackage.zip",
"S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill",
"Overrides": {
"Manifest": {
"apis": {
"custom": {
"endpoint": {
"uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill"
}
}
}
}
}
},
"AuthenticationConfiguration": {
"ClientId": "amzn1.application-oa2-client.1234",
"ClientSecret": "{{resolve:ssm-secure:123456}}",
"RefreshToken": "Atzr|1234"
},
"VendorId": "1234"
}
}
}
}