Analyze security vulnerabilities in Sitecore 10.x projects
Analyzes Sitecore 10.x projects for security vulnerabilities, hardcoded credentials, and configuration issues.
/plugin marketplace add twofoldtech-dakota/claude-marketplace/plugin install twofoldtech-dakota-sitecore-classic-analyzer-plugins-sitecore-classic-analyzer@twofoldtech-dakota/claude-marketplaceIdentify security vulnerabilities, credential exposure, and configuration issues.
Search for credentials in code and config:
Grep: password\s*=\s*["'][^"']+["']
Grep: apikey\s*=\s*["'][^"']+["']
Grep: secret\s*=\s*["'][^"']+["']
Grep: connectionstring.*password
Files to check:
*.config*.cs*.jsonappsettings*.jsonCheck for exposed passwords in connection strings:
<!-- Vulnerable -->
<add name="core" connectionString="Data Source=.;Database=Sitecore_Core;User ID=sa;Password=P@ssw0rd" />
<!-- Better (Windows Auth) -->
<add name="core" connectionString="Data Source=.;Database=Sitecore_Core;Integrated Security=True" />
Search for API keys that should be environment variables:
// Vulnerable
private const string ApiKey = "sk-1234567890abcdef";
// Better
var apiKey = Environment.GetEnvironmentVariable("API_KEY");
Check for overly permissive CORS:
<!-- Vulnerable -->
<add name="Access-Control-Allow-Origin" value="*" />
<!-- Better -->
<add name="Access-Control-Allow-Origin" value="https://specific-domain.com" />
Check for debug settings in production configs:
<!-- Vulnerable in production -->
<compilation debug="true" />
<customErrors mode="Off" />
Check if default admin paths are accessible:
/sitecore/admin/
/sitecore/login/
/sitecore/shell/
Look for IP restrictions in config:
<sitecore>
<settings>
<setting name="Preview.ResolveSite" value="true" />
</settings>
<pipelines>
<preprocessRequest>
<processor type="Sitecore.Pipelines.PreprocessRequest.FilterUrlExtensions, Sitecore.Kernel">
<!-- Check for admin path filtering -->
</processor>
</preprocessRequest>
</pipelines>
</sitecore>
Check for unencoded output in views:
<!-- Vulnerable -->
@Html.Raw(Model.UserInput)
@Model.UntrustedData
<!-- Safe -->
@Html.Encode(Model.UserInput)
@Model.TrustedData
Verify anti-forgery tokens on forms:
<!-- Required on POST forms -->
@Html.AntiForgeryToken()
// Required on controller actions
[ValidateAntiForgeryToken]
public ActionResult Submit(FormModel model)
Check for logging of sensitive information:
// Vulnerable
_logger.LogInformation($"User {username} logged in with password {password}");
| Code | Severity | Issue | Detection |
|---|---|---|---|
| SEC-001 | Critical | Hardcoded credentials in config | Password/key patterns in *.config |
| SEC-002 | Critical | Connection string password exposed | Plain text password in connectionStrings |
| SEC-003 | Critical | API key in source code | API key patterns in *.cs files |
| SEC-004 | Warning | Overly permissive CORS | Access-Control-Allow-Origin: * |
| SEC-005 | Warning | Missing anti-forgery tokens | POST forms without @Html.AntiForgeryToken |
| SEC-006 | Warning | Debug mode enabled | compilation debug="true" |
| SEC-007 | Warning | CustomErrors Off | customErrors mode="Off" |
| SEC-008 | Info | Default admin path | No IP restrictions on /sitecore/ |
| SEC-009 | Info | Potential XSS | Html.Raw with user input |
Glob: **/App_Config/**/*.config
Glob: **/Web.config
Glob: **/ConnectionStrings.config
Glob: **/appsettings*.json
Search for credential patterns
Glob: **/*.cs
Grep: (password|apikey|secret|token)\s*=\s*["']
Grep: \.Raw\(
Grep: Access-Control-Allow-Origin
Grep: EnableCors
Grep: AntiForgeryToken
Grep: ValidateAntiForgeryToken
## Security Analysis
### Security Score: B+
### Critical Issues
#### [SEC-001] Hardcoded Credentials
**Location**: `App_Config/ConnectionStrings.config:8`
**Issue**: SQL password visible in plain text
**Code**:
```xml
<add name="core" connectionString="...Password=P@ssw0rd..." />
Fix: Use Windows Authentication or Azure Key Vault
Location: src/Feature/Integration/code/Services/PaymentService.cs:12
Issue: Stripe API key hardcoded
Code:
private const string StripeKey = "sk_live_...";
Fix: Move to environment variable or secure configuration
Location: Web.config:45
Issue: CORS allows all origins
Fix: Specify allowed domains explicitly