Weak Encoding for Password

Opis

Obscuring a password with a trivial encoding does not protect the password.

Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.

Przykłady podatności

• CVE-2022-45099 network attached storage (NAS) product uses weak encoding for a password

Słabość nadrzędna

• CWE-522 Insufficiently Protected Credentials

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

The "crypt" family of functions uses weak cryptographic algorithms and should be avoided. It may be present in some projects for compatibility.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. Building Secure Software: How to Avoid Security Problems the Right Way — John Viega, Gary McGraw, Addison-Wesley, 2002
3. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 19: Use of Weak Password-Based Systems." Page 279, McGraw-Hill, 2010