CS.HCC.PWD

Use of hard-coded credentials (password)

If software contains hard-coded credentials for authentication, the software is highly vulnerable to attacks because a malicious user has the opportunity to extract this information from the executable file.

The CS.HCC.PWD checker detects the use of hard-coded passwords as parameters for authentication functions. The CS.HCC.PWD checker also detects cases where software compares user credentials with internal hard-coded values in back-end applications. Hard-coded credentials may not only be coded as credentials used to authenticate a function; they may also be used as a hard-coded check. If a username or a password of an authentication function is compared to a hard-coded string, this is also a vulnerability. By default, this checker considers the functions from popular software libraries, but can also be configured to detect custom authentication functions.

Vulnerability and risk

The use of hard-coded credentials makes it possible for an attacker to extract the credentials from the executable file and bypass the authentication. Hard-coded credentials create a significant risk that may be difficult to detect and to fix.

Mitigation and prevention

For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, implement a "first login" mode that requires the user to enter a unique strong password or key.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
   namespace HCC_PWD
   {
       class Program
       {
           int VerifyAdminPassword(String pwd)
           {
               if (pwd.Equals("pwd@123"))
               {
                   Console.WriteLine("Entering Diagnostic Mode...");
                  return (1);
              }
              Console.WriteLine("Incorrect pwd");
              return (0);
          }
      }
  }

In this example, Klocwork reports a defect at line 7, indicating the Use of a hardcoded password through the call to function 'System.String.Equals'.

Fixed code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
   namespace Data
   {
       public class Database
       {
           public static int VerifyPwd(string pwd)
           {
               //verify pwd at database
               return 1;
           }
      }
  }
  
  namespace HCC_PWD
  {
      class Program
      {
          int VerifyAdminUser(String pwd)
          {
             return Data.Database.VerifyPwd(pwd);
          }
      }
  }

In this fixed example, Klocwork no longer reports a defect.

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Sensitive Data Exposure Training Video - Test your skills with a training example