1235
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 312 Cleartext Storage of Sensitive Information 764
PeerOf 214 Invocation of Process Using Visible Sensitive Information 549
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Encrypt information stored in the environment variable to protect it from being exposed to an
unauthorized user. If encryption is not feasible or is considered too expensive for the business
use of the application, then consider using a properly protected configuration file instead of an
environment variable. It should be understood that unencrypted information in a config file is also
not guaranteed to be protected, but it is still a better choice, because it reduces attack surface
related to weaknesses such as CWE-214. In some settings, vaults might be a feasible option
for safer data transfer. Users should be notified of the business choice made to not protect the
sensitive information through encryption.
Phase: Implementation
If the environment variable is not necessary for the desired behavior, then remove it entirely, or
clear it to an empty value.
Observed Examples
Reference Description
CVE-2022-43691 CMS shows sensitive server-side information from environment variables when
run in Debug mode.
https://www.cve.org/CVERecord?id=CVE-2022-43691
CVE-2022-27195 Plugin for an automation server inserts environment variable contents into
build XML files.
https://www.cve.org/CVERecord?id=CVE-2022-27195
CVE-2022-25264 CI/CD tool logs environment variables related to passwords add Contribution
to content history.
https://www.cve.org/CVERecord?id=CVE-2022-25264
MemberOf Relationships
CWE Version 4.14
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere
CWE-527: Exposure of Version-Control
Repository to an Unauthorized Control Sphere 1236
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP23 Exposed Data
References
[REF-1318]David Fiser, Alfredo Oliveira. "Analyzing the Hidden Danger of Environment Variables
for Keeping Secrets". 2022 August 7. < https://www.trendmicro.com/en_us/research/22/h/
analyzing-hidden-danger-of-environment-variables-for-keeping-secrets.html >.2023-01-26.
[REF-1319]Nicolas Harraudeau. "Using environment variables is security-sensitive". 2021 April 8. <
https://sonarsource.atlassian.net/browse/RSPEC-5304 >.2023-01-26.
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control
Sphere
Weakness ID : 527
Structure : Simple
Abstraction : Variant
Description
The product stores a CVS, git, or other repository in a directory, archive, or other resource that is
stored, transferred, or otherwise made accessible to unauthorized actors.
Extended Description
Version control repositories such as CVS or git store version-specific metadata and other details
within subdirectories. If these subdirectories are stored on a web server or added to an archive,
then these could be used by an attacker. This information may include usernames, filenames, path
root, IP addresses, and detailed "diff" data about how files have been changed - which could reveal
source code snippets that were never intended to be made public.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 552 Files or Directories Accessible to External Parties 1265
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
CWE Version 4.14
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere