CWE-319: Cleartext Transmission of Sensitive Information

Description

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Potential Impact

Demonstrative Examples

try {URL u = new URL("http://www.secret.example.org/");HttpURLConnection hu = (HttpURLConnection) u.openConnection();hu.setRequestMethod("PUT");hu.connect();OutputStream os = hu.getOutputStream();hu.disconnect();}catch (IOException e) {
                           //...
                           
                     }

az storage account show -g {ResourceGroupName} -n {StorageAccountName}

{
		   
		     "name": "{StorageAccountName}",
		     "enableHttpsTrafficOnly": false,
		     "type": "Microsoft.Storage/storageAccounts"
		   
		   }

az storage account update -g {ResourceGroupName} -n {StorageAccountName} --https-only true

{
		   
		     "name": "{StorageAccountName}",
		     "enableHttpsTrafficOnly": true,
		     "type": "Microsoft.Storage/storageAccounts"
		   
		   }

Mitigations & Prevention

Detection Methods

• Black Box — Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software was not developed by you, or if you want to verify that the build phase did not introduce any new wea
• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• PLOVER: — Plaintext Transmission of Sensitive Information
• The CERT Oracle Secure Coding Standard for Java (2011): SEC06-J — Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar
• The CERT Oracle Secure Coding Standard for Java (2011): SER02-J — Sign then seal sensitive objects before sending them outside a trust boundary
• Software Fault Patterns: SFP23 — Exposed Data
• ISA/IEC 62443: Part 3-3 — Req SR 4.1
• ISA/IEC 62443: Part 4-2 — Req CR 4.1B