CWE-312 敏感数据的明文存储
Cleartext Storage of Sensitive Information
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
扩展描述
Because the information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 1003 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 311 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 922 cwe_View_ID: 1000
-
cwe_Nature: ChildOf cwe_CWE_ID: 922 cwe_View_ID: 699
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
Paradigm: {'cwe_Name': 'Mobile', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Confidentiality | Read Application Data | An attacker with access to the system could read sensitive information stored in cleartext. |
示例代码
例
The following code excerpt stores a plaintext user account ID in a browser cookie.
bad Java
Because the account ID is in plaintext, the user's account information is exposed if their computer is compromised by an attacker.
例
This code writes a user's login information to a cookie so the user does not have to login again later.
bad PHP
setcookie ("userdata", $data);
}
The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie.
Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315).
例
The following code attempts to establish a connection, read in a password, then store it to a buffer.
bad C
if (hp==NULL) error("Unknown host");
memcpy( (char )&server.sin_addr,(char )hp->h_addr,hp->h_length);
if (argc else port = (unsigned short)atoi(argv[3]);
server.sin_port = htons(port);
if (connect(sock, (struct sockaddr *)&server, sizeof server) ...
while ((n=read(sock,buffer,BUFSIZE-1))!=-1) {
write(dfd,password_buffer,n);
...
While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors.
例
The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in plaintext.
This Java example shows a properties file with a plaintext username / password pair.
bad Java
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...
The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in plaintext.
bad ASP.NET
...
Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information and avoid CWE-260 and CWE-13.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2009-2272 | password and username stored in cleartext in a cookie | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2272 |
| CVE-2009-1466 | password stored in cleartext in a file with insecure permissions | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1466 |
| CVE-2009-0152 | chat program disables SSL in some circumstances even when the user says to use SSL. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0152 |
| CVE-2009-1603 | Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1603 |
| CVE-2009-0964 | storage of unencrypted passwords in a database | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0964 |
| CVE-2008-6157 | storage of unencrypted passwords in a database | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6157 |
| CVE-2008-6828 | product stores a password in cleartext in memory | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6828 |
| CVE-2008-1567 | storage of a secret key in cleartext in a temporary file | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1567 |
| CVE-2008-0174 | SCADA product uses HTTP Basic Authentication, which is not encrypted | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0174 |
| CVE-2007-5778 | login credentials stored unencrypted in a registry key | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5778 |
| CVE-2001-1481 | Plaintext credentials in world-readable file. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1481 |
| CVE-2005-1828 | Password in cleartext in config file. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1828 |
| CVE-2005-2209 | Password in cleartext in config file. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2209 |
| CVE-2002-1696 | Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1696 |
| CVE-2004-2397 | Plaintext storage of private key and passphrase in log file when user imports the key. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2397 |
| CVE-2002-1800 | Admin password in plaintext in a cookie. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1800 |
| CVE-2001-1537 | Default configuration has cleartext usernames/passwords in cookie. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1537 |
| CVE-2001-1536 | Usernames/passwords in cleartext in cookies. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1536 |
| CVE-2005-2160 | Authentication information stored in cleartext in a cookie. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2160 |
Notes
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Plaintext Storage of Sensitive Information | ||
| Software Fault Patterns | SFP23 | Exposed Data |
相关攻击模式
- CAPEC-37
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论