C and C++ Binaries

HARDCODED.SALT : Hardcoded Crypto Salt

Summary

A function that should have a cryptographic salt passed in a particular argument position has been passed a hardcoded value.

Properties

Class Name Hardcoded Crypto Salt
Significance security
Mnemonic HARDCODED.SALT
Categories
CWE CWE:318 Cleartext Storage of Sensitive Information in Executable
  CWE:760 Use of a One-Way Hash with a Predictable Salt
  CWE:798 Use of Hard-coded Credentials
CERT-C CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code
  CERT-C:MSC41-C Never hard code sensitive information
OWASP-2017 OWASP-2017:A5 Broken access control
  OWASP-2017:A6 Security misconfiguration
OWASP-2021 OWASP-2021:A1 Broken access control
  OWASP-2021:A5 Security misconfiguration
  OWASP-2021:A7 Identification and authorization failures
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Hardcoded Crypto Salt"

Example 

#include <crypt.h>

void hardcoded_salt(const char *p, const char *q){
    crypt(p, "salt");  /* 'Hardcoded Crypto Salt' warning issued here
                        * ('Use of crypt' warning also issued)
                        */
    crypt(p, q);                 /* ok: not hardcoded */
                       /* ('Use of crypt' warning issued here)*/
}

Notes

This class is defined using HARDCODED_ARGS_* rules in the general template configuration file, and covers many common procedures that take cryptographic salt parameters. For a full list, see the "Factory Settings" in the documentation for HARDCODED_ARGS_*.

Relevant Configuration File Parameters

This class is implemented using a HARDCODED_ARGS_* rule set in the general template configuration file.

The following configuration file parameters affect checks for this warning class.