From 632cc19fa27abdc30ec3e6cdb0512806dec24e11 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 21 May 2025 08:56:26 +0200 Subject: [PATCH] fix(m365powershell): add `sanitize` to `test_credentials` (#7797) Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> --- prowler/CHANGELOG.md | 1 + prowler/providers/m365/lib/powershell/m365_powershell.py | 4 ++-- tests/providers/m365/lib/powershell/m365_powershell_test.py | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index bc9c799aa1..b43b937fda 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -12,6 +12,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Update CIS 4.0 for M365 provider. [(#7699)](https://github.com/prowler-cloud/prowler/pull/7699) - Cover policies with conditions with SNS endpoint in `sns_topics_not_publicly_accessible`. [(#7750)](https://github.com/prowler-cloud/prowler/pull/7750) +- Fix `m365_powershell test_credentials` to use sanitized credentials. [(#7761)](https://github.com/prowler-cloud/prowler/pull/7761) - Change severity logic for `ec2_securitygroup_allow_ingress_from_internet_to_all_ports` check. [(#7764)](https://github.com/prowler-cloud/prowler/pull/7764) --- diff --git a/prowler/providers/m365/lib/powershell/m365_powershell.py b/prowler/providers/m365/lib/powershell/m365_powershell.py index f32921b001..c61c014888 100644 --- a/prowler/providers/m365/lib/powershell/m365_powershell.py +++ b/prowler/providers/m365/lib/powershell/m365_powershell.py @@ -86,10 +86,10 @@ class M365PowerShell(PowerShellSession): bool: True if credentials are valid and authentication succeeds, False otherwise. """ self.execute( - f'$securePassword = "{credentials.passwd}" | ConvertTo-SecureString' + f'$securePassword = "{self.sanitize(credentials.passwd)}" | ConvertTo-SecureString' ) self.execute( - f'$credential = New-Object System.Management.Automation.PSCredential("{credentials.user}", $securePassword)\n' + f'$credential = New-Object System.Management.Automation.PSCredential("{self.sanitize(credentials.user)}", $securePassword)' ) decrypted_password = self.execute( 'Write-Output "$($credential.GetNetworkCredential().Password)"' diff --git a/tests/providers/m365/lib/powershell/m365_powershell_test.py b/tests/providers/m365/lib/powershell/m365_powershell_test.py index 66094aa581..2ff03f3e76 100644 --- a/tests/providers/m365/lib/powershell/m365_powershell_test.py +++ b/tests/providers/m365/lib/powershell/m365_powershell_test.py @@ -114,7 +114,7 @@ class Testm365PowerShell: f'$securePassword = "{credentials.passwd}" | ConvertTo-SecureString' ) session.execute.assert_any_call( - f'$credential = New-Object System.Management.Automation.PSCredential("{credentials.user}", $securePassword)\n' + f'$credential = New-Object System.Management.Automation.PSCredential("{session.sanitize(credentials.user)}", $securePassword)' ) session.execute.assert_any_call( 'Write-Output "$($credential.GetNetworkCredential().Password)"'