The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What CVEs are caused by CWE-522?

521 recorded CVEs are attributed to CWE-522, including CVE-2021-30116, CVE-2020-29583, CVE-2017-9248. 5 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Is CWE-522 part of the OWASP Top 10?

CWE-522 maps to OWASP Top Ten 2007: Broken Authentication and Session Management (A7) in the OWASP security taxonomy.

How do you prevent CWE-522?

Use an appropriate security mechanism to protect the credentials.

How is CWE-522 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-522?

Exploiting CWE-522 can lead to: Gain Privileges or Assume Identity.

Is CWE-522 actively exploited?

Yes. 5 CWE-522 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 521 recorded CVEs.

CWE-522: Insufficiently Protected Credentials

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This code changes a user's password.

Vulnerable example

php

$user = $_GET['user'];

While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.

The following code reads a password from a properties file and uses the password to connect to a database.

This code will run successfully, but anyone who has access to config.properties can read the value of password. If a devious employee has access to this information, they can use it to break into the system.

The following code reads a password from the registry and uses the password to create a new network credential.

This code will run successfully, but anyone who has access to the registry key used to store the password can read the value of password. If a devious employee has access to this information, they can use it to break into the system

Both of these examples verify a password by comparing it to a stored compressed version.

Vulnerable example

int VerifyAdmin(char *password) {

Vulnerable example

java

int VerifyAdmin(String password) {

Because a compression algorithm is used instead of a one way hashing algorithm, an attacker can recover compressed passwords stored in the database.

The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.

Vulnerable example

java

# Java Web App ResourceBundle properties file

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

Multiple vendors used cleartext transmission or storage of passwords in their OT products.

CWE-522: Insufficiently Protected Credentials

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-522

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-522