Storing sensitive data in plaintext in a file, or on disk, makes the data more easily accessible than if encrypted. This significantly lowers the difficulty of exploitation by attackers.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Demonstrative Examples
Example 1
The following examples show a portion of properties and
configuration files for Java and ASP.NET applications. The files include
username and password information but they are stored in
plaintext.
This Java example shows a properties file with a plaintext username /
password pair.
(Bad Code)
Example
Language: Java
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...
The following example shows a portion of a configuration file for an
ASP.Net application. This configuration file includes username and
password information for a connection to a database but the pair is
stored in plaintext.
Username and password information should not be included in a configuration file or a properties file in plaintext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information and avoid CWE-260 and CWE-13
Plaintext storage of private key and passphrase in
log file when user imports the key.
Potential Mitigations
Secret information should not be stored in plaintext in a file or
disk. Even if heavy fortifications are in place, sensitive data should
be encrypted to prevent the risk of losing confidentiality.
Description
