microsoft / microsoft/powerbi-powershell
WindowsAuthenticationFactory InitializeCache doesn't encrypt passwords
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 413
- Forks
- 134
- Avg merge
- 33m
- Merged PRs (30d)
- 1
Description
Concerns: WindowsAuthenticationFactory.cs
Defender ATP shows us a Base64 encrypted password when we use the InitializeCache Method. This makes it so that decryption isn't hard to do.
When going through the code we noticed that there was a todo in the part which causes this issue on line 111:
if(userName != null && password != null)
{
var pwBytes = Encoding.UTF8.GetBytes(password.SecureStringToString());
var pwBase64 = Convert.ToBase64String(pwBytes);
// TODO encrypt with AES or MachineKey (as long as it works with .NET Framework and .NET Core)
windowAuthProcess.StartInfo.Arguments += $" -User:\"{userName}\" -PW:\"{pwBase64}\"";
}
Please strengthen the way that this data is encrypted.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in WindowsAuthenticationFactory.cs at InitializeCache and the line 111 block that converts the SecureString password to UTF-8 and Base64 before constructing the process arguments. Determine a framework-compatible protection approach for .NET Framework and .NET Core; done means the password is no longer exposed through the current reversible Base64 representation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100