CWE-257 (以可恢复格式存储口令) — Vulnerability Class 63

63 vulnerabilities classified as CWE-257 (以可恢复格式存储口令). AI Chinese analysis included.

CWE-257 represents a critical data storage weakness where passwords are kept in a recoverable format, such as reversible encryption or plaintext, rather than using one-way cryptographic hashing. This flaw is typically exploited by malicious insiders or attackers who gain access to the database, allowing them to decrypt stored credentials and engage in password reuse attacks across multiple systems. Because the original passwords can be retrieved, this practice offers no security advantage over storing them in plain text and significantly increases the blast radius of a breach. To avoid this vulnerability, developers must implement strong, salted hashing algorithms like bcrypt or Argon2, ensuring that passwords are irreversibly transformed and cannot be recovered even if the storage medium is compromised.

MITRE CWE Description

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Common Consequences (2)

Confidentiality, Access Control Gain Privileges or Assume Identity

User's passwords may be revealed.

Access Control Gain Privileges or Assume Identity

Revealed passwords may be reused elsewhere to impersonate the users in question.

Mitigations (1)

Architecture and Design Use strong, non-reversible encryption to protect stored passwords.

Examples (2)

Both of these examples verify a password by comparing it to a stored compressed version.

int VerifyAdmin(char *password) { if (strcmp(compress(password), compressed_password)) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }

Bad · C

int VerifyAdmin(String password) { if (passwd.Equals(compress(password), compressed_password)) { return(0); } //Diagnostic Mode return(1); }

Bad · Java

The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.

# Java Web App ResourceBundle properties file ... webapp.ldap.username=secretUsername webapp.ldap.password=secretPassword ...

Bad · Java

... <connectionStrings> <add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;" providerName="System.Data.Odbc" /> </connectionStrings> ...

Bad · ASP.NET

CVE ID	Title	CVSS	Severity	Published
CVE-2019-5615	Rapid7 InsightVM Stored Credential Exposure — InsightVM	6.5	-	2019-04-09
CVE-2018-5446	Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format — 2090 CareLink Programmer	4.9	Medium	2018-05-04
CVE-2017-9942	Siemens SiPass integrated 安全漏洞 — SiPass integrated All versions before V2.70	7.8	-	2017-08-08

Vulnerabilities classified as CWE-257 (以可恢复格式存储口令) represent 63 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.