CWE-540: Inclusion of Sensitive Information in Source Code

Description

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Submission Date :

July 19, 2006, midnight

Modification Date :

2023-10-26 00:00:00+00:00

Organization :

MITRE

Extended Description

There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.

Example Vulnerable Codes

Example - 1

The following code uses an include file to store database credentials:

database.inc


<?php$dbName = 'usersDB';$dbPassword = 'skjdh#67nkjd3$3$';?>


<?phpinclude('database.inc');$db = connectToDB($dbName, $dbPassword);$db.authenticateUser($username, $password);?>

If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.

Example - 2

The following comment, embedded in a JSP, will be displayed in the resulting HTML output.

<!-- FIXME: calling this with more than 30 args kills the JDBC server -->

Related Weaknesses

This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.

CWE-531: Inclusion of Sensitive Information in Test Code

Go to

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Go to

CWE-541: Inclusion of Sensitive Information in an Include File

Go to

CWE-615: Inclusion of Sensitive Information in Source Code Comments

Go to

Visit http://cwe.mitre.org/ for more details.