767
Example Language: ASP.NET (Bad)
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
Username and password information should not be included in a configuration file or a properties
file in cleartext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
Example 5:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
At least one OT product stored a password in plaintext.
Example 6:
In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web
Service (AWS) Simple Storage Service (S3) buckets.
Example Language: Other (Bad)
A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data
unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses,
phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]
While it was not publicly disclosed how the data was protected after discovery, multiple options
could have been considered.
Example Language: Other (Good)
The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by
enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have
been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucketserver-
side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked.
[REF-1297]
Example 7:
Consider the following PowerShell command examples for encryption scopes of Azure storage
objects. In the first example, an encryption scope is set for the storage account.
Example Language: Shell (Bad)
New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -
EncryptionScopeName testscope -StorageEncryption
The result (edited and formatted for readability) might be:
Example Language: Other (Bad)
ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount
CWE Version 4.14
CWE-312: Cleartext Storage of Sensitive Information
CWE-312: Cleartext Storage of Sensitive Information