名称: Weak Encoding for Password
The product uses a weak or trivial encoding for a password.
基本信息
引入方式
Architecture and Design : Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base64 encoding, but this effort does not adequately protect the password.Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Access Control | Gain Privileges or Assume Identity |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2022-45099 | network attached storage (NAS) product uses weak encoding for a password |
潜在缓解措施
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.检测方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有效性 : High
漏洞映射说明
依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
相关攻击模式
| CAPEC ID | 攻击模式名称 |
|---|---|
| CAPEC-55 | Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system. |
备注
参考资料
REF-6
Seven Pernicious Kingdoms: A Taxonomy of Software Security ErrorsKatrina Tsipenyuk, Brian Chess, Gary McGraw.
https://cwe.mitre.org/documents/sources/SevenPerniciousKingdoms.pdf
REF-207
Building Secure Software: How to Avoid Security Problems the Right WayJohn Viega, Gary McGraw.
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| 7 Pernicious Kingdoms | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Veracode | Suggested OWASP Top Ten 2004 mapping | ||
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Description, Name, Other_Notes, References, Relationships, Type | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Description, Modes_of_Introduction, References |
