Password in Configuration File

Opis

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design

  Avoid storing passwords in easily accessible locations.

• Architecture and Design

  Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.

Przykłady podatności

• CVE-2022-38665 A continuous delivery pipeline management tool stores an unencypted password in a configuration file.

Słabość nadrzędna

• CWE-522 Insufficiently Protected Credentials

Słabości podrzędne

• CWE-13 ASP.NET Misconfiguration: Password in Configuration File
• CWE-258 Empty Password in Configuration File
• CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
• Implementation

Dotyczy

Not Language-Specific

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. Building Secure Software: How to Avoid Security Problems the Right Way — John Viega, Gary McGraw, Addison-Wesley, 2002