Reino: Security Features

La seguridad de un software no es un software de seguridad. Nos preocupamos de cuestiones como la autenticación, el control de acceso, la confidencialidad, la criptografía y la gestión de privilegios.

Credential Management: Hardcoded Username

ColdFusion
Java/JSP

Abstract

Los nombres de usuario codificados pueden poner en riesgo la seguridad del sistema de una forma que no es fácil de resolver.

Explanation

Nunca es una buena idea integrar un nombre de usuario en el código. Integrar un nombre de usuario en el código no solo permite a todos los desarrolladores del proyecto ver el nombre de usuario, sino que también hace que sea extremadamente difícil solucionar el problema. Una vez que el código está en producción, el nombre de usuario no se puede cambiar sin aplicar revisiones al software. Si la cuenta protegida por el nombre de usuario se ve comprometida, los propietarios del sistema deberán elegir entre la seguridad y la disponibilidad.
Ejemplo 1: El siguiente código utiliza un nombre de usuario con codificación rígida para conectarse a una base de datos:


...
<cfquery name = "GetSSNs" dataSource = "users"
 username = "scott" password = "tiger">
SELECT   SSN
FROM     Users
</cfquery>
...

Este código se ejecutará correctamente, pero cualquier usuario que tenga acceso al mismo tendrá acceso al nombre de usuario. Una vez que se haya distribuido el programa, no se podrá cambiar el usuario de base de datos "scott" con la contraseña "tiger", a menos que el programa tenga instaladas las revisiones. Un empleado con acceso a esta información podría utilizarla para irrumpir en el sistema.

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 255

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001199, CCI-002367, CCI-003109

[3] Standards Mapping - FIPS200 MP

[4] Standards Mapping - General Data Protection Regulation (GDPR) Privacy Violation

[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 IA-5 Authenticator Management (P1), SA-4 Acquisition Process (P1), SC-28 Protection of Information at Rest (P1)

[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-4 Acquisition Process, SC-28 Protection of Information at Rest

[7] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.10.2 Service Authentication Requirements (L2 L3)

[8] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[9] Standards Mapping - OWASP Mobile 2024 M1 Improper Credential Usage

[10] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-AUTH-1

[11] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[12] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[13] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[14] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[15] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[16] Standards Mapping - OWASP Top 10 2021 A07 Identification and Authentication Failures

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.8, Requirement 8.4

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 6.5.3, Requirement 6.5.6, Requirement 8.6.2

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 6.5.3, Requirement 6.5.6, Requirement 8.6.2

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.3 - Authentication and Access Control

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.3 - Authentication and Access Control

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.3 - Authentication and Access Control, Control Objective C.2.1.2 - Web Software Access Controls

[29] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II, APP3350 CAT I

[30] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II, APP3350 CAT I

[31] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II, APP3350 CAT I

[32] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II, APP3350 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II, APP3350 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II, APP3350 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II, APP3350 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002330 CAT II, APSC-DV-003110 CAT I, APSC-DV-003270 CAT II

[51] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

desc.semantic.cfml.credential_management_hardcoded_username

Abstract

Los nombres de usuario codificados pueden poner en riesgo la seguridad del sistema de una forma que no es fácil de resolver.

Explanation


...
Credentials.basic("hardcoded-username", password);
...