CWE-540: Inclusion of Sensitive Information in Source Code
Description
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-10-26 00:00:00+00:00
Organization :
MITRE
Extended Description
There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.
Example - 1
The following code uses an include file to store database credentials: database.inc login.php If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.
<?php$dbName = 'usersDB';$dbPassword = 'skjdh#67nkjd3$3$';?>
<?phpinclude('database.inc');$db = connectToDB($dbName, $dbPassword);$db.authenticateUser($username, $password);?>
Example - 2
The following comment, embedded in a JSP, will be displayed in the resulting HTML output.
<!-- FIXME: calling this with more than 30 args kills the JDBC server -->Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
CWE-531: Inclusion of Sensitive Information in Test Code
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-541: Inclusion of Sensitive Information in an Include File
CWE-615: Inclusion of Sensitive Information in Source Code Comments
Visit http://cwe.mitre.org/ for more details.