CWE-256: Plaintext Storage of a Password

What is Plaintext Storage of a Password?

• Overview: Storing a password in plaintext means keeping the password in its original, readable form without encryption or hashing, which makes it easily accessible to anyone who can access the storage medium, such as files or memory.

• Exploitation Methods:

• Attackers can exploit this vulnerability by accessing files or memory locations where plaintext passwords are stored, often through unauthorized file access or memory dumps.
• Common attack patterns include reading configuration files or application properties files where plaintext passwords are stored, or exploiting memory vulnerabilities to retrieve passwords from memory.

• Security Impact:

• Direct consequences of successful exploitation include unauthorized access to password-protected resources, accounts, or systems.
• Potential cascading effects include further breaches within the network if the compromised credentials are reused or have elevated privileges.
• Business impact can include data breaches, loss of customer trust, legal liabilities, and financial losses due to unauthorized transactions or service disruptions.

• Prevention Guidelines:

• Specific code-level fixes include using secure password storage mechanisms like hashing with salt or encryption rather than plaintext storage.
• Security best practices involve minimizing password storage, using environment variables for sensitive data, and ensuring passwords are removed from memory after use.
• Recommended tools and frameworks include using libraries that handle password storage securely, such as bcrypt for hashing or using key management systems for encryption.

Corgea can automatically detect and fix Plaintext Storage of a Password in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: High

Affected Languages: Not Language-Specific

Affected Technologies: ICS/OT

Vulnerable Code Example

const fs = require('fs');

function storePassword(username, password) {
    // Vulnerable: Storing password as plaintext in a file
    // If the file is accessed, the password can be easily read
    fs.writeFileSync(`\${username}_password.txt`, password);
}

How to fix Plaintext Storage of a Password?

In JavaScript, especially for Node.js environments, it's critical to never store passwords as plaintext. Instead, use a secure hashing library like bcrypt to hash passwords before storage. bcrypt provides a secure way to hash passwords with a salt, making it resistant to brute force and rainbow table attacks. Always ensure the use of a strong hashing algorithm and manage your secrets responsibly.

Fixed Code Example

const fs = require('fs');
const bcrypt = require('bcrypt');

function storePassword(username, password) {
    // Fixed: Hash the password before storing
    // A salt is generated automatically by bcrypt, enhancing security
    bcrypt.hash(password, 10, (err, hashedPassword) => {
        if (err) {
            console.error('Error hashing password:', err);
            return;
        }
        
        // Store the hashed password instead of the plaintext password
        fs.writeFileSync(`\${username}_password.txt`, hashedPassword);
    });
}

Explanation:

1. Vulnerable Code: The initial example demonstrates storing a password directly as plaintext, which is a severe security risk. If the file is accessed by unauthorized users, the password is exposed.

2. Fixed Code: The improved example uses bcrypt to hash the password before storing it. This process includes generating a salt automatically, which is combined with the password to produce a secure hash. This ensures that even if the storage medium is compromised, the actual passwords remain protected. The error handling is added to manage potential hashing errors gracefully, which is a best practice in secure coding.