[Security] Database Credential Leakage via Debug Logging and Persistent Environment Variables (CWE-532)

[appsecguardian-hash]

Summary

Two related credential leakage issues exist in the database backup/restore handlers:

Issue A: MongoDB URI with Credentials Logged at Debug Level

Files: `service/mongodb/backup.go:59`, `service/mongodb/restore.go:54`

log.Debugf("executing mongodb backup command: %v", strings.Join(command, " "))

The command array includes `--uri mongodb://user:password@host:27017/db`, logging the full connection URI with embedded credentials. Any log aggregation system (ELK, Splunk, Cloud Foundry Loggregator) captures these credentials.

Issue B: Process-Wide Environment Variables Never Cleaned Up

Files: `service/mysql/backup.go:35`, `service/mysql/restore.go:32`, `service/postgres/backup.go:37-40`, `service/postgres/restore.go:31-34`

os.Setenv("MYSQL_PWD", service.Binding.Password)
os.Setenv("PGPASSWORD", service.Binding.Password)
os.Setenv("PGHOST", service.Binding.Host)
os.Setenv("PGPORT", service.Binding.Port)

These set process-global environment variables that persist for the entire process lifetime and are never cleaned up with `os.Unsetenv()`. All subsequent child processes (gzip, encryption tools, etc.) inherit database credentials.

Severity

MEDIUM — CVSS 3.1: 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CWE-532 (Insertion of Sensitive Information into Log File)
CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer)

Impact

• Database credentials exposed to log aggregation pipelines
• Credentials visible via `/proc//environ` on Linux
• Cross-service credential contamination in multi-database deployments (MySQL password set, then PostgreSQL backup runs — MySQL creds still in env)

Suggested Fix

Issue A:

// Redact URI before logging
redactedCmd := make([]string, len(command))
copy(redactedCmd, command)
for i, arg := range redactedCmd {
    if strings.HasPrefix(arg, "mongodb://") {
        redactedCmd[i] = "mongodb://[REDACTED]"
    }
}
log.Debugf("executing mongodb backup command: %v", strings.Join(redactedCmd, " "))

Issue B:

defer os.Unsetenv("MYSQL_PWD")
defer os.Unsetenv("PGPASSWORD")
defer os.Unsetenv("PGHOST")
defer os.Unsetenv("PGPORT")
defer os.Unsetenv("PGUSER")

Or pass credentials via the command's `Env` field instead of process-global environment.

Disclosure

This report was generated with the assistance of AI-based analysis tools.

Reported by: Ashish Kunwar (ashishkunwar280@gmail.com)