Overview

We have identified a security issue in the Power Platform Terraform Provider where sensitive information, specifically the client_secret used in the service principal authentication, may be exposed in logs. This exposure occurs due to an error in the logging code that causes the client_secret to not be properly masked when logs are persisted or viewed.

Details

The issue arises when the Terraform provider sets up logging fields and attempts to mask sensitive information such as client_secret. Due to a typographical error involving an unexpected newline character (\n), the client_secret field is not correctly identified for masking, leading to its value being included in logs.

If logging is configured to persist to a file or an external logging system, this could result in the client_secret being inadvertently exposed, posing a security risk. Users who have configured persistent logging are at higher risk of having this sensitive information compromised.

Affected Logging Configuration

• Default Behavior: By default, Terraform logs are not persisted and are kept in memory. This issue is less severe if logs are not explicitly configured to be written to a file or an external system.
• Custom Logging Configuration: If the TF_LOG_PATH environment variable is set or if logs are redirected to an external system, the client_secret may be exposed in the logs. This includes any configuration that redirects or saves logs to a file, monitoring system, or logging service.

Impact

The impact of this issue includes the potential exposure of the client_secret used in the service principal for authenticating with Azure or other services. If an attacker gains access to this client_secret via the logs, they could potentially gain unauthorized access to the services or resources associated with the service principal.

Mitigation Steps

Users who have used this provider with the affected versions should take the following steps to mitigate the risk:

1. Rotate Secrets:
   - Service Principal: Immediately rotate the client_secret for any service principal that has been configured using this Terraform provider. This will invalidate any potentially exposed secrets.

2. Disable Persistent Logging:

   • If you have set the TF_LOG_PATH environment variable or configured Terraform to persist logs to a file or an external system, consider disabling this until you have updated to a fixed version of the provider.
   • To disable logging to a file, unset the TF_LOG_PATH environment variable: unset TF_LOG_PATH

3. Sanitize Existing Logs:

   • If you have existing logs that may contain the client_secret, remove or sanitize these logs to prevent unauthorized access. This includes logs on disk, in monitoring systems, or in logging services.

4. Update to Fixed Version:

   • We have released a patched version of the provider that removes all logging of sensitive content. Update to the latest version to ensure this issue is resolved:

     terraform {
       required_providers {
         powerplatform = {
           source  = "microsoft/power-platform"
           version = ">= 3.0.0"
         }
       }
     } 

5. Use OIDC for Authentication:

   • We recommend switching to OpenID Connect (OIDC) for authentication instead of using client secrets. OIDC provides a more secure and manageable approach by eliminating the need to manage and rotate secrets.
   • Update your Terraform configuration to use OIDC for authentication:

     provider "powerplatform" {
       use_oidc = true
       # Other OIDC configuration options
     }

Recommendations

• Audit Your Logs: Regularly audit your logs to ensure no sensitive information is being recorded and apply appropriate log management practices to handle sensitive data securely.
• Prefer secretless authentication: When possible, prefer OIDC or Managed Identities to reduce the risk of secret exposure.

References

• Link to Provider Documentation on OIDC Authentication
• Fixed in Release v3.0.0

Summary

This advisory addresses an issue where the client_secret could be exposed in logs due to improper masking. Users are advised to rotate secrets, update to the latest provider version, sanitize existing logs, and consider using OIDC for improved security.