名前: Use of Hard-coded Cryptographic Key

The product uses a hard-coded, unchangeable cryptographic key.

一般情報

導入モード

Architecture and Design : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)
名前： Go (Undetermined)

テクノロジー

クラス： ICS/OT (Undetermined)

一般的な結果

スコープ	影響	可能性
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data 注記：If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

観察された例

参考文献	説明
CVE-2022-29960	Engineering Workstation uses hard-coded cryptographic keys that could allow for unauthorized filesystem access and privilege escalation
CVE-2022-30271	Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used in typical deployments.
CVE-2020-10884	WiFi router service has a hard-coded encryption key, allowing root access
CVE-2014-2198	Communications / collaboration product has a hardcoded SSH private key, allowing access to root account

潜在的な緩和策

Phases : Architecture and Design
Prevention schemes mirror that of hard-coded password storage.

検出方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有効性 : High

脆弱性マッピングノート

理由 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

ノート

The main difference between the use of hard-coded passwords and the use of hard-coded cryptographic keys is the false sense of security that the former conveys. Many people believe that simply hashing a hard-coded password before storage will protect the information from malicious users. However, many hashes are reversible (or at least vulnerable to brute force attacks) -- and further, many authentication protocols simply request the hash itself, making it no better than a password.

参考文献

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

REF-1283

OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management
Forescout Vedere Labs.
https://www.forescout.com/resources/ot-icefall-report/

REF-1534

Automated Technical Debt Measure, Version 2
OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF

REF-1566

Golang Secure Coding Practices guide
OWASP.
https://github.com/OWASP/Go-SCP

登録情報

名前	組織	日付	リリース日	Version
CLASP		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

変更履歴

名前	組織	日付	コメント
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
	Veracode	2008-08-15 +00:00	Suggested OWASP Top Ten 2004 mapping
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2009-05-27 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2010-02-16 +00:00	updated Relationships
CWE Content Team	MITRE	2010-09-27 +00:00	updated Relationships
CWE Content Team	MITRE	2010-12-13 +00:00	updated Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Demonstrative_Examples, Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Demonstrative_Examples, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Demonstrative_Examples, Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated References, Relationships, Type
CWE Content Team	MITRE	2020-08-20 +00:00	updated Relationships
CWE Content Team	MITRE	2020-12-10 +00:00	updated Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated Demonstrative_Examples, Observed_Examples, References
CWE Content Team	MITRE	2023-01-31 +00:00	updated Applicable_Platforms, Maintenance_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2025-04-03 +00:00	updated Common_Consequences, Description, Diagram
CWE Content Team	MITRE	2025-12-11 +00:00	updated Maintenance_Notes, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings

CWE-321 詳細

CWE-321