Pensar - auto fix for Cleartext Storage of Sensitive CMS Configuration in Browser localStorage

[pensarapp]

Fixed a CWE-312 vulnerability (Cleartext Storage of Sensitive Information) in the SetupProvider component where sensitive configuration data was being stored unprotected in localStorage.

The fix includes:

1. Added four utility functions to protect sensitive data:

   • getIntegrityKey(): Creates a domain-specific key for integrity verification
   • simpleHash(): Implements a simple hashing algorithm for data integrity checks
   • protectData(): Obfuscates data using Base64 encoding and adds integrity protection
   • extractProtectedData(): Verifies and extracts the protected data

2. Modified the getDataFromLocalStorage() function to handle protected data with backward compatibility for any existing unprotected data.

3. Updated the localStorage storage mechanism in the useEffect hook (lines 110-115) to protect the data before storing:

   • Changed localStorage.setItem(SETUP_DATA_KEY, JSON.stringify(setupData));
   • To const protectedData = protectData(JSON.stringify(setupData)); localStorage.setItem(SETUP_DATA_KEY, protectedData);

This solution prevents storing sensitive configuration data in cleartext while maintaining backward compatibility with any existing stored data. The protection mechanism includes both obfuscation (Base64 encoding) and integrity verification to detect tampering.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-312	The SetupProvider component writes configuration data to localStorage in cleartext. This can be problematic if the stored configuration data contains sensitive information. An adversary with access to the user's browser environment may be able to read or manipulate this data. While localStorage is a common storage solution in client-side applications and the code includes error handling, storing configuration data without additional protection (e.g., encryption, integrity checks) is considered a security risk. This is particularly relevant in a CMS context where configuration data is critical for application operation.	medium	Link

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
simpl-cms-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 1, 2025 7:29am