CWE-319: Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information
Weakness ID: 319 (Weakness Base)
Status: Draft
Description
Description Summary
The software transmits sensitive or security-critical data in
cleartext in a communication channel that can be sniffed by unauthorized
actors.
Extended Description
Many communication channels can be "sniffed" by attackers during data
transmission. For example, network traffic can often be sniffed by any
attacker who has access to a network interface. This significantly lowers
the difficulty of exploitation by attackers.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Confidentiality
Anyone can read the contents of the message if they have access to any
channel being used for communication.
Product sends file with cleartext passwords in
e-mail message intended for diagnostic purposes.
Potential Mitigations
Phase
Description
Architecture and Design
Encrypt the data with a reliable encryption scheme before
transmitting.
Implementation
When using web applications with SSL, use SSL for the entire session
from login to logout, not just for the initial login page.
Testing
Use tools and techniques that require manual (human) analysis, such as
penetration testing, threat modeling, and interactive tools that allow
the tester to record and modify an active session. These may be more
effective than strictly automated techniques. This is especially the
case with weaknesses that are related to design and business
rules.
Testing
Use monitoring tools that examine the software's process as it
interacts with the operating system and the network. This technique is
useful in cases when source code is unavailable, if the software was not
developed by you, or if you want to verify that the build phase did not
introduce any new weaknesses. Examples include debuggers that directly
attach to the running process; system-call tracing utilities such as
truss (Solaris) and strace (Linux); system activity monitors such as
FileMon, RegMon, Process Monitor, and other Sysinternals utilities
(Windows); and sniffers and protocol analyzers that monitor network
traffic.
Attach the monitor to the process, trigger the feature that sends the
data, and look for the presence or absence of common cryptographic
functions in the call tree. Monitor the network and determine if the
data packets contain readable commands. Tools exist for detecting if
certain encodings are in use. If the traffic contains high entropy, this
might indicate the usage of encryption.
Operation
Configure servers to use encrypted channels for communication, which
may include SSL or other secure protocols.
Description
