8. of Spoofing
An attacker could steal credentials stored on the server and reuse them (for example, a key is stored in a world-readable file).
|
Threat |
|
|
|
You’ve stored a private key in a PEM file that isn’t encrypted, and access isn’t restricted. |
|
CAPEC |
CAPEC-191 - Read Sensitive Constants Within an Executable CAPEC-150 - Collect Data from Common Resource Locations |
|
ASVS |
2.10.4 - Ensure Keys and Secret material are stored securely and ensure that secrets aren’t hardcoded in source files |
|
CWE |
CWE-257 - Storing Passwords in a Recoverable Format CWE-256 - Plaintext Storage of a Password CWE-522 - Insufficiently Protected Credentials CWE-798 - Use of Hard-coded Credentials ... |
