C and C++ Binaries

MISC.PWD.PLAIN : Plaintext Storage of Password

Summary

A password is stored without encryption, then subsequently used for authentication.

Properties

Class Name Plaintext Storage of Password
Significance security
Mnemonic MISC.PWD.PLAIN
Categories
CWE CWE:256 Plaintext Storage of a Password
  CWE:311 Missing Encryption of Sensitive Data
  CWE:313 Cleartext Storage in a File or on Disk
  CWE:316 Cleartext Storage of Sensitive Information in Memory
  CWE:318 Cleartext Storage of Sensitive Information in Executable
CERT-C CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code
DISA-6r1 DISA-6r1:V-222542 The application must only store cryptographic representations of passwords.
  DISA-6r1:V-222543 The application must transmit only cryptographically-protected passwords.
DISA-5r3 DISA-5r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-5r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-4r3 DISA-4r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-4r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-3r10 DISA-3r10:V-16796 The designer will ensure the application transmits account passwords in an approved encrypted format.
  DISA-3r10:V-16797 The designer will ensure the application stores account passwords in an approved encrypted format.
OWASP-2017 OWASP-2017:A2 Broken authentication
  OWASP-2017:A3 Sensitive data exposure
  OWASP-2017:A5 Broken access control
OWASP-2021 OWASP-2021:A1 Broken access control
  OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A7 Identification and authorization failures
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Plaintext Storage of Password"

Example 

#include <stdio.h>
#include <windows.h>
#include <sqltypes.h>
#include <sqlext.h>

void setup_connection(SQLCHAR *server_name, FILE *nmpasswd ){
    RETCODE rc; 
    HENV henv; 
    HDBC hdbc; 
    HSTMT hstmt;
    SQLCHAR uname[16];
    SQLCHAR passwd[32];
   
    if (fgets(uname, 16, nmpasswd) == NULL ) return;
    if (fgets(passwd, 32, nmpasswd) == NULL ) return;

    SQLAllocEnv(&henv);
    SQLAllocConnect(henv, &hdbc);
    if( !hdbc ) abort();
    rc = SQLConnectA(hdbc, /* Plaintext Storage of Password warning issued here */
                     server_name, SQL_NTS, 
                     uname, 16, 
                     passwd, 32);
    /* ... */
    exit(0);
}

Note that if the password argument to SQLConnectA() were specified as a literal string in the file (rather than being retrieved from a file), CodeSonar would issue a Hardcoded Authentication warning instead.

Triggers

CodeSonar ships with library models that allow it to recognize functions such as Win32 LogonUserA()/LogonUserW() that can use a password for authentication. If one of these functions is called with a potentially-cleartext-stored value in the password parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Plaintext Storage of Password warnings.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.