Passwords stored in plaintext.

EDIT THIS TITLE BEFORE POSTING. Use this template for bug reports. If you'd like to request a feature, please be as descriptive as possible and delete the template except the first section (Request Type)

Request Type

Bug

Work Environment

Problem Description

Sensitive data (private key and passwords in the configurations) are stored in an unencrypted manner on the Cortex component after being entered in a responder's configuration. Therefore, an attacker gaining access to this component can obtain all the secrets stored there. These passwords are only accessible to users with administrative rights, so the impact is limited.

Steps to Reproduce

1. Log in with administrator account
2. Make request to : /api/responder?range=all&sort=%2Bname
3. You can see plaintext password frm responders configuration

Possible Solutions

Can you hash passwords before storing ?

Complementary information

Start with the /api/responder?range=all&sort=+name endpoint and reproduce the response using the administrator steps in the issue. Trace how responder configuration secrets are stored and serialized; done means passwords and private keys are not exposed in plaintext through this endpoint, with the security behavior covered by tests.