782
The following code attempts to establish a connection to a site to communicate sensitive
information.
Example Language: Java (Bad)
try {
URL u = new URL("http://www.secret.example.org/");
HttpURLConnection hu = (HttpURLConnection) u.openConnection();
hu.setRequestMethod("PUT");
hu.connect();
OutputStream os = hu.getOutputStream();
hu.disconnect();
}
catch (IOException e) {
//...
}
Though a connection is successfully made, the connection is unencrypted and it is possible that all
sensitive data sent to or received from the server will be read by unintended actors.
Example 2:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors used cleartext transmission of sensitive information in their OT products.
Example 3:
A TAP accessible register is read/written by a JTAG based tool, for internal use by authorized
users. However, an adversary can connect a probing device and collect the values from the
unencrypted channel connecting the JTAG interface to the authorized user, if no additional
protections are employed.
Example 4:
The following Azure CLI command lists the properties of a particular storage account:
Example Language: Shell (Informative)
az storage account show -g {ResourceGroupName} -n {StorageAccountName}
The JSON result might be:
Example Language: JSON (Bad)
{
"name": "{StorageAccountName}",
"enableHttpsTrafficOnly": false,
"type": "Microsoft.Storage/storageAccounts"
}
The enableHttpsTrafficOnly value is set to false, because the default setting for Secure transfer
is set to Disabled. This allows cloud storage resources to successfully connect and transfer data
without the use of encryption (e.g., HTTP, SMB 2.1, SMB 3.0, etc.).
Azure's storage accounts can be configured to only accept requests from secure connections
made over HTTPS. The secure transfer setting can be enabled using Azure's Portal (GUI) or
programmatically by setting the enableHttpsTrafficOnly property to True on the storage account,
such as:
CWE Version 4.14
CWE-319: Cleartext Transmission of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information