The following code excerpt stores a plaintext user account ID in a browser cookie.
Because the account ID is in plaintext, the user's account information is exposed if their computer is compromised by an attacker.
BadJava
response.addCookie( new Cookie("userAccountID", acctID);
This code writes a user's login information to a cookie so the user does not have to login again later.
The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie.
BadPHP
function persistLogin($username, $password){$data = array("username" => $username, "password"=> $password);setcookie ("userdata", $data);}
The following code attempts to establish a connection, read in a password, then store it to a buffer.
While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors.
BadC
server.sin_family = AF_INET; hp = gethostbyname(argv[1]);if (hp==NULL) error("Unknown host");memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length);if (argc < 3) port = 80;else port = (unsigned short)atoi(argv[3]);server.sin_port = htons(port);if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error("Connecting");...while ((n=read(sock,buffer,BUFSIZE-1))!=-1) { write(dfd,password_buffer,n);...
The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.
This Java example shows a properties file with a cleartext username / password pair.
BadJava
# Java Web App ResourceBundle properties file ...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...
The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.
This Java example shows a properties file with a cleartext username / password pair.
BadASP.NET
...<connectionStrings><add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /></connectionStrings>...
In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web Service (AWS) Simple Storage Service (S3) buckets.
While it was not publicly disclosed how the data was protected after discovery, multiple options could have been considered.
BadOther
A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses, phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]
In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web Service (AWS) Simple Storage Service (S3) buckets.
While it was not publicly disclosed how the data was protected after discovery, multiple options could have been considered.
GoodOther
The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucket-server-side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked. [REF-1297]
Consider the following PowerShell command examples for encryption scopes of Azure storage objects. In the first example, an encryption scope is set for the storage account.
The result (edited and formatted for readability) might be:
BadShell
New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -EncryptionScopeName testscope -StorageEncryption
Consider the following PowerShell command examples for encryption scopes of Azure storage objects. In the first example, an encryption scope is set for the storage account.
The result (edited and formatted for readability) might be:
BadOther
ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount Name State Source RequireInfrastructureEncryption testscope Enabled Microsoft.Storage
Consider the following PowerShell command examples for encryption scopes of Azure storage objects. In the first example, an encryption scope is set for the storage account.
The result (edited and formatted for readability) might be:
GoodShell
New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -EncryptionScopeName testscope -StorageEncryption -RequireInfrastructureEncryption