1695
Example Language: Java (Bad)
int VerifyAdmin(String password) {
if (!password.equals("Mew!")) {
return(0)
}
//Diagnostic Mode
return(1);
}
Every instance of this program can be placed into diagnostic mode with the same password. Even
worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to
change that password or disable this "functionality."
Example 3:
The following code examples attempt to verify a password using a hard-coded cryptographic key.
Example Language: C (Bad)
int VerifyAdmin(char *password) {
if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) {
printf("Incorrect Password!\n");
return(0);
}
printf("Entering Diagnostic Mode...\n");
return(1);
}
Example Language: Java (Bad)
public boolean VerifyAdmin(String password) {
if (password.equals("68af404b513073584c4b6f22b6c63e6b")) {
System.out.println("Entering Diagnostic Mode...");
return true;
}
System.out.println("Incorrect Password!");
return false;
Example Language: C# (Bad)
int VerifyAdmin(String password) {
if (password.Equals("68af404b513073584c4b6f22b6c63e6b")) {
Console.WriteLine("Entering Diagnostic Mode...");
return(1);
}
Console.WriteLine("Incorrect Password!");
return(0);
}
The cryptographic key is within a hard-coded string value that is compared to the password. It is
likely that an attacker will be able to read the key and compromise the system.
Example 4:
The following examples show a portion of properties and configuration files for Java and ASP.NET
applications. The files include username and password information but they are stored in cleartext.
This Java example shows a properties file with a cleartext username / password pair.
Example Language: Java (Bad)
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
CWE Version 4.14
CWE-798: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials