[avd-ksv-0109] bitnami/redis helm chart "Storing secrets in configMaps is unsafe" false detection

[ktzsolt]

IDs

avd-ksv-0109

Description

Scanning the helm chart bitnami/redis with trivy config will give the following false detections:

redis-20.6.3.tgz:templates/health-configmap.yaml (helm)

Tests: 10 (SUCCESSES: 9, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-KSV-0109 (HIGH): ConfigMap 'redis-health' in '' namespace stores secrets in key(s) or value(s) '{"[[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD", "[[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD"}'
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Storing secrets in configMaps is unsafe

See https://avd.aquasec.com/misconfig/avd-ksv-0109
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

redis-20.6.3.tgz:templates/scripts-configmap.yaml (helm)

Tests: 10 (SUCCESSES: 9, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-KSV-0109 (HIGH): ConfigMap 'redis-scripts' in '' namespace stores secrets in key(s) or value(s) '{"[[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD", "[[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD"}'
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Storing secrets in configMaps is unsafe

See https://avd.aquasec.com/misconfig/avd-ksv-0109
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

When in fact the ConfigMap keys contain only shell scripts that are referencing REDIS_PASSWORD environment variable but the REDIS_PASSWORD variable value is not stored in the ConfigMap. The REDIS_PASSWORD env var is created in the container from the release-name-redis Secret like this:

- name: REDIS_PASSWORD
  valueFrom:
    secretKeyRef:
      name: release-name-redis
      key: redis-password

Reproduction Steps

1. helm repo add bitnami https://charts.bitnami.com/bitnami  
2. helm repo update bitnami
3. helm pull bitnami/redis --version 20.6.3  
3. trivy config redis-20.6.3.tgz --severity HIGH,CRITICAL

Target

Kubernetes

Scanner

Misconfiguration

Target OS

No response

Debug Output

trivy config redis-20.6.3.tgz --severity HIGH,CRITICAL --debug

2025-01-31T18:47:55+01:00       DEBUG   No plugins loaded
2025-01-31T18:47:55+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-01-31T18:47:55+01:00       DEBUG   Cache dir       dir="/home/ktzsolt/.cache/trivy"
2025-01-31T18:47:55+01:00       DEBUG   Cache dir       dir="/home/ktzsolt/.cache/trivy"
2025-01-31T18:47:55+01:00       DEBUG   Parsed severities       severities=[HIGH CRITICAL]
2025-01-31T18:47:55+01:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-31T18:47:55+01:00       DEBUG   [misconfig] Checks successfully loaded from disk
2025-01-31T18:47:55+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-01-31T18:47:55+01:00       DEBUG   Initializing scan cache...      type="memory"
2025-01-31T18:47:55+01:00       DEBUG   [fs] Analyzing...       root="redis-20.6.3.tgz"
2025-01-31T18:47:55+01:00       DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /tmp/redis-20.6.3.tgz/.git: not a directory"
2025-01-31T18:47:55+01:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Helm"
2025-01-31T18:47:55+01:00       DEBUG   [rego] Overriding filesystem for checks
2025-01-31T18:47:55+01:00       DEBUG   [rego] Embedded libraries are loaded    count=17
2025-01-31T18:47:55+01:00       DEBUG   [rego] Embedded checks are loaded       count=517
2025-01-31T18:47:55+01:00       DEBUG   [rego] Checks from disk are loaded      count=534
2025-01-31T18:47:55+01:00       DEBUG   [rego] Overriding filesystem for data
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/Chart.lock"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/Chart.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/.helmignore"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/Chart.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/.helmignore"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/README.md"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/values.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_warnings.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_affinities.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_storage.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_utils.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_compatibility.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_tplvalues.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_capabilities.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_labels.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_errors.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_resources.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_names.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_validations.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_postgresql.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_mariadb.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_cassandra.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_redis.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_mongodb.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/validations/_mysql.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_secrets.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_images.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/charts/common/templates/_ingress.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/README.md"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/values.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/networkpolicy.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/_helpers.tpl"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/servicemonitor.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/role.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/hpa.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/node-services.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/statefulset.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/sentinel/ports-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/metrics-svc.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/extra-list.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/NOTES.txt"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/pvc.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/psp.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/master/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/secret-svcbind.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/secret.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/prometheusrule.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/tls-secret.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/podmonitor.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/rolebinding.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/health-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/scripts-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/replicas/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/replicas/hpa.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/replicas/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/replicas/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/replicas/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/templates/headless-svc.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [helm parser] Unpacking tar entry       file_path="redis/values.schema.json"
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/networkpolicy.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/master/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/replicas/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/master/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/replicas/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/secret.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/health-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/scripts-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/headless-svc.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/master/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/replicas/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/master/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   [helm scanner] Processing rendered chart file   file_path="templates/replicas/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   [rego] Scanning inputs  count=1
2025-01-31T18:47:56+01:00       DEBUG   OS is not detected.
2025-01-31T18:47:56+01:00       INFO    Detected config files   num=14
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/master/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/master/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/master/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/master/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/networkpolicy.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/replicas/application.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/replicas/pdb.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/replicas/service.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/replicas/serviceaccount.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/scripts-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/secret.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/headless-svc.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Scanned config file     file_path="redis-20.6.3.tgz:templates/health-configmap.yaml"
2025-01-31T18:47:56+01:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-01-31T18:47:56+01:00       DEBUG   [vex] VEX filtering is disabled

redis-20.6.3.tgz:templates/health-configmap.yaml (helm)

Tests: 10 (SUCCESSES: 9, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-KSV-0109 (HIGH): ConfigMap 'redis-health' in '' namespace stores secrets in key(s) or value(s) '{"[[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD", "[[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD"}'
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Storing secrets in configMaps is unsafe

See https://avd.aquasec.com/misconfig/avd-ksv-0109
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────



redis-20.6.3.tgz:templates/scripts-configmap.yaml (helm)

Tests: 10 (SUCCESSES: 9, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-KSV-0109 (HIGH): ConfigMap 'redis-scripts' in '' namespace stores secrets in key(s) or value(s) '{"[[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD", "[[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD"}'
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Storing secrets in configMaps is unsafe

See https://avd.aquasec.com/misconfig/avd-ksv-0109
────────

Version

Version: 0.59.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-01-31 12:17:46.90810596 +0000 UTC
  NextUpdate: 2025-02-01 12:17:46.908105379 +0000 UTC
  DownloadedAt: 2025-01-31 16:45:04.392630963 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-01-17 03:57:43.687377672 +0000 UTC
  NextUpdate: 2025-01-20 03:57:43.687376771 +0000 UTC
  DownloadedAt: 2025-01-17 10:33:09.036314856 +0000 UTC
Check Bundle:
  Digest: sha256:ac89e7d82ab5feeabc055a454066bc182f9248e96b8ecb1ca5810cd59c659800
  DownloadedAt: 2025-01-31 17:12:46.336590551 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[simar7]

thanks for the report @ktzsolt - you're right in the sense that this is a false positive.

The current check does a regex match and checks to see if there's a value set. In this case the value is set but is evaluated from env vars.

@nikpivkin I recall we had a similar issue earlier with another check, didn't we?

[ktzsolt]

Hi @simar7! We still have this as false positive with trivy 0.63.0, can you advise how to remediate this with a workaround or something until it is fixed? Thanks!

[simar7]

@ktzsolt - looks like we missed this.

@nikpivkin could you take a look?

[nikpivkin]

Duplicate of #8865

[ktzsolt]

Could we reopen this please, because I still experience the issue described here in this discussion even though fixes was made as per #8865

• @simar7