CWE-260: Password in Configuration File

What is Password in Configuration File?

• Overview: Password in Configuration File (CWE-260) occurs when a program stores a password within a configuration file, which can be accessed by unauthorized individuals, leading to security breaches.

• Exploitation Methods:

• Attackers can gain unauthorized access to the configuration file to read stored passwords.
• Common attack patterns include file system scanning and exploiting weak file permissions.

• Security Impact:

• Direct consequences include unauthorized access to systems or data that the password protects.
• Potential cascading effects involve attackers gaining further access to networked systems or sensitive information.
• Business impact includes data breaches, loss of customer trust, and potential financial penalties.

• Prevention Guidelines:

• Specific code-level fixes include avoiding storing plain text passwords in configuration files.
• Security best practices involve using environment variables, encrypted storage solutions, or secure vault services for managing sensitive information.
• Recommended tools and frameworks include HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault for secure secret management.

Corgea can automatically detect and fix Password in Configuration File in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

# This is a vulnerable configuration file storing sensitive passwords in plaintext.
# Storing passwords in plaintext can lead to leakage if the file is accessed by unauthorized users.

config = {
    "database": {
        "host": "localhost",
        "username": "admin",
        "password": "supersecret123"  # Vulnerable: Password stored in plaintext
    }
}

def connect_to_db():
    # Code to connect to the database using the password from the config
    pass

How to fix Password in Configuration File?

To properly fix the vulnerability of storing passwords in configuration files, follow these best practices:

1. Environment Variables: Store sensitive information like passwords in environment variables instead of hardcoding them into files.
2. Secret Management Tools: Use secret management tools or services (e.g., AWS Secrets Manager, HashiCorp Vault) to securely store and access sensitive information.
3. Encryption: If passwords must be stored in files, encrypt them using strong encryption standards, and ensure that decryption keys are stored securely and separately.
4. Access Controls: Ensure strict access controls on configuration files to limit who can read or modify them.

Fixed Code Example

import os

# Use environment variables to store sensitive information securely
config = {
    "database": {
        "host": "localhost",
        "username": "admin",
        "password": os.getenv("DB_PASSWORD")  # Fixed: Retrieve password from environment variable
    }
}

def connect_to_db():
    # Code to connect to the database using the password from the config
    pass

Additional Steps:

• Set Environment Variable: Ensure that the environment variable DB_PASSWORD is set in your deployment environment.
• Secure Deployment: Make sure your deployment scripts or platforms are set up to securely manage these environment variables without exposing them in logs or error messages.

These improvements ensure the code examples are clear, realistic, and follow best practices for securely managing sensitive information in configuration files.