13
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-65]M. Howard, D. LeBlanc and J. Viega. "19 Deadly Sins of Software Security". 2005 July 6.
McGraw-Hill/Osborne.
[REF-66]OWASP, Fortify Software. "ASP.NET Misconfiguration: Missing Custom Error Handling". <
http://www.owasp.org/index.php/ASP.NET_Misconfiguration:_Missing_Custom_Error_Handling >.
CWE-13: ASP.NET Misconfiguration: Password in Configuration File
Weakness ID : 13
Structure : Simple
Abstraction : Variant
Description
Storing a plaintext password in a configuration file allows anyone who can read the file access to
the password-protected resource making them an easy target for attackers.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 260 Password in Configuration File 629
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Potential Mitigations
Phase: Implementation
Credentials stored in configuration files should be encrypted, Use standard APIs and industry
accepted algorithms to encrypt the credentials stored in configuration files.
Demonstrative Examples
Example 1:
The following example shows a portion of a configuration file for an ASP.Net application. This
configuration file includes username and password information for a connection to a database, but
the pair is stored in plaintext.
Example Language: ASP.NET (Bad)
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
CWE Version 4.14
CWE-14: Compiler Removal of Code to Clear Buffers
CWE-14: Compiler Removal of Code to Clear Buffers