CWE-259Use of Hard-coded Password

Description

Common consequences· 2

• Access Control — Gain Privileges or Assume Identity
  If hard-coded passwords are used, it is almost certain that malicious users can gain access through the account in question.
• Access Control — Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability
  A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely.

Potential mitigations· 5

• [Architecture and Design]For outbound authentication: store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible.
• [Architecture and Design]For inbound authentication: Rather than hard-code a default username and password for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password.
• [Architecture and Design]Perform access control checks and limit which entities can access the feature that requires the hard-coded password. For example, a feature might only be enabled through the system console instead of through a network connection.
• [Architecture and Design]
• [Architecture and Design]

Compliance frameworks addressing this (incoming)3

(incoming)29

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.