Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2017-14021—A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-EPSS 1.9%CVE-2014-5403—Hospira MedNet Use of Hard-coded Cryptographic KeyEPSS 1.7%CVE-2022-0664HIGHUse of Hard-coded Cryptographic Key in gravitl/netmakerEPSS 1.7%CVE-2022-24860HIGHDatabasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.EPSS 1.7%CVE-2016-9335—A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware VersionEPSS 1.6%CVE-2022-23650HIGHUse of Hard-coded Cryptographic Key in NetmakerEPSS 1.6%CVE-2019-10920—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which isEPSS 1.5%CVE-2020-6979—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibilitEPSS 1.5%CVE-2020-6983—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-cEPSS 1.5%CVE-2018-0040CRITICALContrail Service Orchestration: hardcoded cryptographic certificates and keysEPSS 1.4%CVE-2019-10990MEDIUMRed Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected fEPSS 1.3%CVE-2019-13929—A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1EPSS 1.3%CVE-2017-7574CRITICALSchneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. TheEPSS 1.3%CVE-2022-29830CRITICALUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control SettinEPSS 1.2%CVE-2023-39482MEDIUMSofting Secure Integration Server Hardcoded Cryptographic Key Information Disclosure VulnerabilityEPSS 1.2%CVE-2022-22987CRITICALAdvantech ADAM-3600EPSS 1.2%CVE-2022-29186CRITICALUse of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterpriseEPSS 1.2%CVE-2021-27392—A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), SivEPSS 1.2%CVE-2022-20773HIGHCisco Umbrella Virtual Appliance Static SSH Host Key VulnerabilityEPSS 1.2%CVE-2020-28395—A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 andEPSS 1.2%