Database Connection String Password

ID

db_connection_string

Severity

high

Remediation Complexity

trivial

Remediation Risk

high

Remediation Effort

medium

Family

Data Storage Secret

Description

A database connection string bundles everything an application needs to reach a database — host, port, database name, user and, frequently, the password. The semicolon-delimited key=value form (ADO.NET / OLE DB / ODBC) and the jdbc: URL form are shared across many engines: Microsoft SQL Server, Azure SQL, Oracle (ODP.NET), PostgreSQL (Npgsql), MySQL (ADO.NET connector), and others.

This detector reports the password embedded inside such a connection string (the Password= / Pwd= attribute), regardless of the key under which the whole string is stored (e.g. ConnectionString, spring.datasource.url).

Security

Unlike the key-based database-password detectors, the credential here is hidden inside the value of a single configuration entry, so it is easy to leak unnoticed in appsettings.json, web.config, application.properties, or similar files.

Accidentally checking a connection string with an inline password into source control could compromise the database and every asset reachable from it.

Env-var and placeholder passwords (for example Password=${DB_PASSWORD}) are filtered out to keep the false-positive rate low.

Examples

{
  "ConnectionString": "Server=tcp:example.database.windows.net,1433;Initial Catalog=App;User ID=developer;Password=Sup3rSecret!;Encrypt=True;"
}
spring.datasource.url=jdbc:sqlserver://db.example.com:1433;databaseName=App;user=svc;password=Sup3rSecret!

Mitigation / Fix

  1. Remove the password from the connection string in source code or committed configuration files; load it at runtime from an environment variable or a secrets manager.

  2. Follow your policy for handling leaked secrets, which typically requires revoking/rotating the credential in the target database.

  3. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.

You should consider any sensitive data in commits with secrets as compromised.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference

https://www.connectionstrings.com/