SV.PASSWD.PLAIN.HC

Insufficiently Protected Credentials

This issue occurs when a product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Vulnerability and risk

An attacker could gain access to user accounts and access sensitive data used by the user accounts.

Vulnerable code example

1
2
3
4
   Properties prop = new Properties();
   prop.load(new FileInputStream("config.properties"));
   String password = prop.getProperty("password"); //Defect
   DriverManager.getConnection(url, usr, password);

Klocwork reports an SV.PASSWD.PLAIN.HC defect on line 3 as the above code reads a password from a properties file and uses the password to connect to a database. This code will run successfully, but anyone who has access to the config.properties file can read the value of the password. If, for example, an employee has access to this information, they can use it to break into the system.

Fixed code example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
    /*
     * First, create (or ask some other component for) the adequate encryptor for
     * decrypting the values in the .properties file.
     */
    StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
    encryptor.setPassword("jasypt"); // could be obtained from the web, env variable, etc
    encryptor.setAlgorithm("PBEWithHMACSHA512AndAES_256");
    encryptor.setIvGenerator(new RandomIvGenerator());
     
   /*
    * Create an EncryptableProperties object and load it the usual way.
    */
   Properties props = new EncryptableProperties(encryptor);
   props.load(new FileInputStream("/path/to/my/configuration.properties"));
   
   /*
    * To get an encrypted value, do exactly the same. Decryption will
    * be transparently performed behind the scenes.
    */
   String datasourcePassword = props.getProperty("datasource.password");

Klocwork no longer reports a defect when retrieving the password from the properties file because an encryption technique (Jasypt encryption) is used on the properties file.

Related checkers

• SV.PASSWD.HC
• SV.PASSWD.HC.EMPTY
• SV.PASSWD.PLAIN

External guidance

• CWE-522: Insufficiently Protected Credentials
• OWASP A4:2021 Insecure Design
• CERT MSC03-J: Never hard code sensitive information

Security training

Application security training materials provided by Secure Code Warrior.

• Insufficiently Protected Credentials Training Video - Test your skills with a training example