786
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
If hard-coded cryptographic keys are used, it is almost
certain that malicious users will gain access through the
account in question.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
Demonstrative Examples
Example 1:
The following code examples attempt to verify a password using a hard-coded cryptographic key.
Example Language: C (Bad)
int VerifyAdmin(char *password) {
if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) {
printf("Incorrect Password!\n");
return(0);
}
printf("Entering Diagnostic Mode...\n");
return(1);
}
Example Language: Java (Bad)
public boolean VerifyAdmin(String password) {
if (password.equals("68af404b513073584c4b6f22b6c63e6b")) {
CWE Version 4.14
CWE-321: Use of Hard-coded Cryptographic Key
CWE-321: Use of Hard-coded Cryptographic Key