630
Phase: Architecture and Design
Avoid storing passwords in easily accessible locations.
Phase: Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Demonstrative Examples
Example 1:
Below is a snippet from a Java properties file.
Example Language: Java (Bad)
webapp.ldap.username = secretUsername
webapp.ldap.password = secretPassword
Because the LDAP credentials are stored in plaintext, anyone with access to the file can gain
access to the resource.
Example 2:
The following examples show a portion of properties and configuration files for Java and ASP.NET
applications. The files include username and password information but they are stored in cleartext.
This Java example shows a properties file with a cleartext username / password pair.
Example Language: Java (Bad)
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...
The following example shows a portion of a configuration file for an ASP.Net application. This
configuration file includes username and password information for a connection to a database but
the pair is stored in cleartext.
Example Language: ASP.NET (Bad)
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
Username and password information should not be included in a configuration file or a properties
file in cleartext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
Observed Examples
Reference Description
CVE-2022-38665 A continuous delivery pipeline management tool stores an unencypted
password in a configuration file.
https://www.cve.org/CVERecord?id=CVE-2022-38665
Affected Resources
• File or Directory
MemberOf Relationships
CWE Version 4.14
CWE-261: Weak Encoding for Password
CWE-261: Weak Encoding for Password