CWE-798: Use of Hard-coded Credentials

Description

The product contains hard-coded credentials, such as a password or cryptographic key.

There are two main variations:

Potential Impact

Demonstrative Examples

...DriverManager.getConnection(url, "scott", "tiger");...

javap -c ConnMngr.class22: ldc #36; //String jdbc:mysql://ixne.com/rxsql24: ldc #38; //String scott26: ldc #17; //String tiger

int VerifyAdmin(char *password) {
                        if (strcmp(password, "Mew!")) {
                              
                                 printf("Incorrect Password!\n");return(0)
                           }printf("Entering Diagnostic Mode...\n");return(1);
                     }

int VerifyAdmin(String password) {if (!password.equals("Mew!")) {return(0)}//Diagnostic Modereturn(1);}

int VerifyAdmin(char *password) {
                        if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) {
                              
                                 printf("Incorrect Password!\n");return(0);
                           }printf("Entering Diagnostic Mode...\n");return(1);
                     }

public boolean VerifyAdmin(String password) {if (password.equals("68af404b513073584c4b6f22b6c63e6b")) {System.out.println("Entering Diagnostic Mode...");return true;}System.out.println("Incorrect Password!");return false;

int VerifyAdmin(String password) {if (password.Equals("68af404b513073584c4b6f22b6c63e6b")) {Console.WriteLine("Entering Diagnostic Mode...");return(1);}Console.WriteLine("Incorrect Password!");return(0);}

# Java Web App ResourceBundle properties file
                     ...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...

...<connectionStrings><add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /></connectionStrings>...

Mitigations & Prevention

Detection Methods

• Black Box Moderate — Credential storage in configuration files is findable using black box methods, but the use of hard-coded credentials for an incoming authentication routine typically involves an account that is not visible outside of the code.
• Automated Static Analysis — Automated white box techniques have been published for detecting hard-coded credentials for incoming authentication, but there is some expert disagreement regarding their effectiveness and applicability to a broad range of methods.
• Manual Static Analysis — This weakness may be detectable using manual code analysis. Unless authentication is decentralized and applied throughout the product, there can be sufficient time for the analyst to find incoming authentication routines and examine the program logic looking for usage of hard-coded credentials. Conf
• Manual Dynamic Analysis — For hard-coded credentials in incoming authentication: use monitoring tools that examine the product's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the product was not developed by you, or if you want to veri
• Automated Static Analysis - Binary or Bytecode SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
• Manual Static Analysis - Binary or Bytecode High — According to SOAR [REF-1479], the following detection techniques may be useful:

Real-World CVE Examples

Showing 15 of 20 observed examples.

Related Weaknesses

Taxonomy Mappings

• The CERT Oracle Secure Coding Standard for Java (2011): MSC03-J — Never hard code sensitive information
• OMG ASCSM: ASCSM-CWE-798 —
• ISA/IEC 62443: Part 3-3 — Req SR 1.5
• ISA/IEC 62443: Part 4-2 — Req CR 1.5