Reino: Security Features
La seguridad de un software no es un software de seguridad. Nos preocupamos de cuestiones como la autenticación, el control de acceso, la confidencialidad, la criptografía y la gestión de privilegios.
Credential Management
Abstract
El almacenamiento de un nombre de usuario de texto sin formato podría poner en peligro al sistema.
Explanation
Los problemas de administración de credenciales se producen cuando un nombre de usuario se acepta de un usuario o se almacena como texto sin formato en archivos de configuración o en la base de datos de una aplicación.
Ejemplo 1: El siguiente código lee un nombre de usuario de un formulario web y utiliza el nombre de usuario para conectarse a una base de datos.
Este código se ejecutará correctamente, pero cualquier usuario que tenga acceso a la tabla
Ejemplo 1: El siguiente código lee un nombre de usuario de un formulario web y utiliza el nombre de usuario para conectarse a una base de datos.
<cfquery name = "GetCredentials" dataSource = "master">
SELECT Username, Password
FROM Credentials
WHERE DataSource="users"
</cfquery>
...
<cfquery name = "GetSSNs" dataSource = "users"
username = "#Username#" password = "#Password#">
SELECT SSN
FROM Users
</cfquery>
...
Este código se ejecutará correctamente, pero cualquier usuario que tenga acceso a la tabla
master puede leer el valor de Username y Password. Un empleado malintencionado con acceso a esta información puede utilizarla para irrumpir en el sistema.References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 522
[2] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287
[3] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287, [18] CWE ID 522
[4] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287, [21] CWE ID 522
[5] Standards Mapping - Common Weakness Enumeration Top 25 2022 [14] CWE ID 287
[6] Standards Mapping - Common Weakness Enumeration Top 25 2023 [13] CWE ID 287
[7] Standards Mapping - Common Weakness Enumeration Top 25 2024 [14] CWE ID 287
[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002367
[9] Standards Mapping - FIPS200 MP
[10] Standards Mapping - General Data Protection Regulation (GDPR) Privacy Violation
[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-5 Authenticator Management (P1), SC-28 Protection of Information at Rest (P1)
[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-28 Protection of Information at Rest
[13] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.10.2 Service Authentication Requirements (L2 L3), 2.10.3 Service Authentication Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3)
[14] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication
[15] Standards Mapping - OWASP Mobile 2024 M1 Improper Credential Usage
[16] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1
[17] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage
[18] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage
[19] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage
[20] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 3.4, Requirement 6.5.8
[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.8
[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.4, Requirement 6.5.3
[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.4, Requirement 6.5.3
[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.4, Requirement 6.5.3
[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.4, Requirement 6.5.3
[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.4, Requirement 6.5.3
[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.5.1, Requirement 6.2.4
[29] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 6.2.4
[30] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7 - Use of Cryptography
[31] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7 - Use of Cryptography
[32] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7 - Use of Cryptography
[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II, APP3350 CAT I
[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II, APP3350 CAT I
[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II, APP3350 CAT I
[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II, APP3350 CAT I
[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II, APP3350 CAT I
[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II, APP3350 CAT I
[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II, APP3350 CAT I
[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-003110 CAT I
[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-003110 CAT I
[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-003110 CAT I
[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-003110 CAT I
[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-003110 CAT I
[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-003110 CAT I
[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-003110 CAT I
[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-003110 CAT I
[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-003110 CAT I
[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-003110 CAT I
[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-003110 CAT I
[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-003110 CAT I
[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-003110 CAT I
[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-003110 CAT I
[54] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-003110 CAT I
[55] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)
desc.dataflow.cfml.credential_management