CWE-260: Password in Configuration File

Description

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Extended Description

This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.

ThreatScore

Threat Mapped score: 3.0

Industry: Finiancial

Threat priority: P2 - Serious (High)

Observed Examples (CVEs)

CVE: CVE-2022-38665

A continuous delivery pipeline management tool stores an unencypted password in a configuration file.

Related Attack Patterns (CAPEC)

N/A

Attack TTPs

N/A

Modes of Introduction

Phase	Note
Architecture and Design	OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation	N/A

Common Consequences

Impact: Gain Privileges or Assume Identity — Notes:

Potential Mitigations

Architecture and Design: Avoid storing passwords in easily accessible locations. (N/A)
Architecture and Design: Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext. (N/A)

Applicable Platforms

None (Not Language-Specific, Undetermined)

Demonstrative Examples

Intro: Below is a snippet from a Java properties file.

Body: Because the LDAP credentials are stored in plaintext, anyone with access to the file can gain access to the resource.

webapp.ldap.username = secretUsername webapp.ldap.password = secretPassword

Intro: The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.

Body: This Java example shows a properties file with a cleartext username / password pair.

# Java Web App ResourceBundle properties file ... webapp.ldap.username=secretUsername webapp.ldap.password=secretPassword ...

Notes

No notes available.

← Back to CWE list