CWE-922: Insecure Storage of Sensitive Information

What is Insecure Storage of Sensitive Information?

• Overview: Insecure Storage of Sensitive Information refers to storing sensitive data without properly restricting access. This oversight allows unauthorized users to read or modify sensitive data, leading to theft or tampering.

• Exploitation Methods:

• Attackers can exploit this vulnerability by gaining unauthorized read or write access to the stored sensitive data.
• Common attack patterns include exploiting weak file permissions, leveraging unencrypted storage, and accessing unsecured databases.

• Security Impact:

• Direct consequences include unauthorized data disclosure, data integrity issues, and data loss.
• Potential cascading effects involve compromised user privacy, loss of trust, and legal ramifications.
• Business impact can lead to financial loss, reputational damage, and regulatory penalties.

• Prevention Guidelines:

• Specific code-level fixes include implementing access controls such as role-based access control (RBAC) and encrypting sensitive data both at rest and in transit.
• Security best practices involve regularly auditing access permissions, using strong encryption algorithms, and applying the principle of least privilege.
• Recommended tools and frameworks include using secure storage libraries, database security tools, and encryption frameworks like OpenSSL.

Corgea can automatically detect and fix Insecure Storage of Sensitive Information in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

Certainly! Let's improve the code examples and address the issues you've mentioned:

Python Example

import json

def store_sensitive_info(user_data):
    # Vulnerable code: Sensitive information is stored in plain text
    with open('user_data.json', 'w') as file:
        json.dump(user_data, file)  # Sensitive data is stored in a readable format

Explanation:

In this code snippet, sensitive user information such as passwords, credit card numbers, or personal details are being stored in a plain text JSON file. This makes the data easily accessible to anyone who gains access to the file, leading to a significant security risk.

How to fix Insecure Storage of Sensitive Information?

Fixed Code Example

from cryptography.fernet import Fernet
import json

def generate_key():
    # Generate a key for encryption
    return Fernet.generate_key()

def store_sensitive_info(user_data, key):
    # Create a Fernet object with the provided key
    fernet = Fernet(key)
    
    # Convert user data to JSON-formatted bytes
    user_data_bytes = json.dumps(user_data).encode()
    
    # Encrypt the user data
    encrypted_data = fernet.encrypt(user_data_bytes)
    
    # Store the encrypted data
    with open('user_data.json', 'wb') as file:
        file.write(encrypted_data)  # Encrypted data is securely stored

Key Changes:

• Symmetric Encryption: A strong symmetric encryption algorithm (Fernet) from the cryptography library is used to encrypt user data before writing it to the file.
• Key Management: The encryption key is generated using Fernet.generate_key(). This key must be securely stored and managed separately from the data.
• Data Serialization: The user data is serialized to a JSON-formatted byte string before encryption.
• Binary Storage: Encrypted data is written to the file in binary mode ('wb'), ensuring that sensitive information is not stored in plain text.

By implementing these changes, the sensitive information is protected against unauthorized access, even if the storage file is compromised.