VariantDraftCWE-321

CWE-321: Use of Hard-coded Cryptographic Key

Description

The product uses a hard-coded, unchangeable cryptographic key.

Abstraction: VariantA weakness tied to a specific language, technology or resource.
Likelihood of exploit: High
Status: Draft

Common consequences

Access Control
Bypass Protection Mechanism; Gain Privileges or Assume Identity; Read Application Data
If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Potential mitigations

Architecture and Design
Prevention schemes mirror that of hard-coded password storage.

Related weaknesses

Parent weaknesses

CWE-798Use of Hard-coded Credentials

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Common consequences

Access Control

Bypass Protection Mechanism; Gain Privileges or Assume Identity; Read Application Data

If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.