ASP.NET Misconfiguration: Password in Configuration File

Opis

Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Implementation

  Credentials stored in configuration files should be encrypted, Use standard APIs and industry accepted algorithms to encrypt the credentials stored in configuration files.

Słabość nadrzędna

• CWE-260 Password in Configuration File

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

ASP.NET

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI — Microsoft Corporation
3. How To: Encrypt Configuration Sections in ASP.NET 2.0 Using RSA — Microsoft Corporation
4. .NET Framework Developer's Guide - Securing Connection Strings — Microsoft Corporation