1. Home
  2. CWE Database
  3. CWE-13
Variant · Low-Medium

CWE-13: ASP.NET Misconfiguration: Password in Configuration File

Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

CWE-13 · Variant Level ·1 Mitigations

Description

Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

Potential Impact

Access Control

Gain Privileges or Assume Identity

Demonstrative Examples

The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database, but the pair is stored in plaintext.
Bad
...<connectionStrings><add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /></connectionStrings>...
Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information.

Mitigations & Prevention

Implementation

Credentials stored in configuration files should be encrypted, Use standard APIs and industry accepted algorithms to encrypt the credentials stored in configuration files.

CWE-260: Password in Configuration File

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Taxonomy Mappings

  • 7 Pernicious Kingdoms: — ASP.NET Misconfiguration: Password in Configuration File

Frequently Asked Questions

What is CWE-13?

CWE-13 (ASP.NET Misconfiguration: Password in Configuration File) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.

How can CWE-13 be exploited?

Attackers can exploit CWE-13 (ASP.NET Misconfiguration: Password in Configuration File) to gain privileges or assume identity. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-13?

Key mitigations include: Credentials stored in configuration files should be encrypted, Use standard APIs and industry accepted algorithms to encrypt the credentials stored in configuration files.

What is the severity of CWE-13?

CWE-13 is classified as a Variant-level weakness (Low-Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.