Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

Azure Shared Key Authentication Enabled on Storage Account

The Azure Storage account allows authentication using the legacy Shared Key mechanism because shared_access_key_enabled is not explicitly set to false....

high

Insecure Azure Storage Account Public Access Configuration

high CWE-200 azure Azure

The Azure storage account is not configured to block public network access or prevent nested blob items from becoming publicly...

high

Azure Key Exchange without Entity Authentication

high CWE-322 azure Azure

The Service Fabric cluster does not enforce authenticated and protected inter-node communication. The azurerm_service_fabric_cluster resource is missing a fabric_settings block...

high

Insertion of Sensitive Information into Log File

high CWE-532 azure

The application writes sensitive information to log files. This may include user data, credentials, tokens, full request details, database queries,...

high

Key Management Errors

high CWE-323 CWE-324 CWE-284 azure

The application contains key management weaknesses that may reduce the effectiveness of its cryptographic protections. Nonces are intended to be...

critical

Insufficient Granularity of Access Control

critical CWE-1220 azure

The system implements access controls intended to restrict access to sensitive hardware resources, peripherals, registers, or memory regions. However, the...

high

OT Security Version Number Mutable to Older Versions

high CWE-1328 c operational-technology-ot Operational Technology (OT)

The firmware update process does not validate the currently installed firmware version before applying an update. In firmware_apply_update, the current_version...

high

OT Insufficient Verification of Data Authenticity

high CWE-345 c operational-technology-ot Operational Technology (OT)

The firmware does not sufficiently verify the authenticity of boot components before execution. Boot images are trusted based only on...

high

OT Improper Verification of Cryptographic Signature

high CWE-347 c operational-technology-ot Operational Technology (OT)

The firmware does not properly verify the cryptographic signature of firmware images before execution. If it accepts unsigned, tampered, or...

No matching labs found

Try adjusting your search keywords or language filter.