Cleartext Storage of Sensitive Information

Opis

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Skutki

• Confidentiality

  Read Application Data

  An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Zapobieganie

• Implementation, System Configuration, Operation

  When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]

• Implementation, System Configuration, Operation

  In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Przykłady podatności

• CVE-2022-26390 wireless battery product stores credentials and Personal Health Information (PHI) without encryption
• CVE-2022-30275 Remote Terminal Unit (RTU) uses a driver that relies on a password stored in plaintext.
• CVE-2009-2272 password and username stored in cleartext in a cookie
• CVE-2009-1466 password stored in cleartext in a file with insecure permissions
• CVE-2009-0152 chat program disables SSL in some circumstances even when the user says to use SSL.
• CVE-2009-1603 Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption
• CVE-2009-0964 storage of unencrypted passwords in a database
• CVE-2008-6157 storage of unencrypted passwords in a database
• CVE-2008-6828 product stores a password in cleartext in memory
• CVE-2008-1567 storage of a secret key in cleartext in a temporary file
• CVE-2008-0174 SCADA product uses HTTP Basic Authentication, which is not encrypted
• CVE-2007-5778 login credentials stored unencrypted in a registry key
• CVE-2001-1481 Plaintext credentials in world-readable file.
• CVE-2005-1828 Password in cleartext in config file.
• CVE-2005-2209 Password in cleartext in config file.
• CVE-2002-1696 Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message.
• CVE-2004-2397 Plaintext storage of private key and passphrase in log file when user imports the key.
• CVE-2002-1800 Admin password in plaintext in a cookie.
• CVE-2001-1537 Default configuration has cleartext usernames/passwords in cookie.
• CVE-2001-1536 Usernames/passwords in cleartext in cookies.
• CVE-2005-2160 Authentication information stored in cleartext in a cookie.

Słabość nadrzędna

• CWE-311 Missing Encryption of Sensitive Data
• CWE-922 Insecure Storage of Sensitive Information

Słabości podrzędne

• CWE-313 Cleartext Storage in a File or on Disk
• CWE-314 Cleartext Storage in the Registry
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie
• CWE-316 Cleartext Storage of Sensitive Information in Memory
• CWE-317 Cleartext Storage of Sensitive Information in GUI
• CWE-318 Cleartext Storage of Sensitive Information in Executable
• CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Dotyczy

Not Language-Specific, Cloud Computing, ICS/OT, Mobile

Uwagi

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).

When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.

Źródła

1. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 9, "Protecting Secret Data" Page 299, Microsoft Press, 2002
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 2, "Common Vulnerabilities of Encryption", Page 43, Addison Wesley, 2006
3. Mobile App Top 10 List — Chris Wysopal, 2010
4. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022
5. Over 80 US Municipalities' Sensitive Information, Including Resident's Personal Data, Left Vulnerable in Massive Data Breach — WizCase, 2021
6. 1,000 GB of local government data exposed by Massachusetts software company — Jonathan Greig, 2021
7. AWS Foundational Security Best Practices controls — Amazon, 2022
8. Azure encryption overview — Microsoft, 2022
9. Default encryption at rest — Google Cloud, 2022
10. CIS Microsoft Azure Foundations Benchmark version 1.5.0 — Center for Internet Security, Section 3.2, 2022
11. Enable infrastructure encryption for double encryption of data — Microsoft, 2022