CWE-259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

There are two main variations of a hard-coded password: ``` Inbound: the product contains an authentication mechanism that checks for a hard-coded password. Outbound: the product connects to another system or component, and it contains a hard-coded password for connecting to that component. ```

Common consequences

• Access Control → Gain Privileges or Assume Identity
• Access Control → Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability

Mitigations

• Architecture and Design: For outbound authentication: store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as poss
• Architecture and Design: For inbound authentication: Rather than hard-code a default username and password for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password.
• Architecture and Design: Perform access control checks and limit which entities can access the feature that requires the hard-coded password. For example, a feature might only be enabled through the system console instead of through a network connection.
• Architecture and Design: For inbound authentication: apply strong one-way hashes to your passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When receiving an incoming password during authentication, take the hash of the password and compare it to the has
• Architecture and Design: For front-end to back-end connections: Three solutions are possible, although none are complete. ``` The first suggestion involves the use of generated passwords which are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals. Next, the passwords used shou