Falhas do tipo CWE-798

941 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2017-13108—DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13101—Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13100—DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13106—Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2021-33016CRITICALKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 1.0%CVE-2017-13104—Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13102—Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2026-2635HIGHMLflow Use of Default Password Authentication Bypass VulnerabilityEPSS 1.0%CVE-2022-26671HIGHTAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded CredentialsEPSS 1.0%CVE-2018-0039MEDIUMContrail Service Orchestration: Hardcoded credentials for Grafana serviceEPSS 1.0%CVE-2023-33236CRITICALMXsecurity Hardcoded Credential VulnerabilityEPSS 1.0%CVE-2022-21194—The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUMEPSS 1.0%CVE-2020-3318HIGHCisco Firepower Management Center Static Credential VulnerabilitiesEPSS 1.0%CVE-2023-25187MEDIUMAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factEPSS 1.0%CVE-2017-13107—Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2023-35724HIGHD-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-37287CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 2EPSS 0.9%CVE-2022-22522CRITICALHard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the deviceEPSS 0.9%CVE-2020-5222MEDIUMHard-Coded Key Used For Remember-me Token in OpenCastEPSS 0.9%CVE-2022-48113CRITICALA vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POSTEPSS 0.9%