# Cleartext Transmission of Sensitive Information (CWE-319)

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

**Stack:** Go

- Prevalence: Alta Frequentemente explorada
- Impact: Alto 5 regras de severidade alta
- Prevention: Documentada 6 exemplos de correção

**OWASP:** Cryptographic Failures (A02:2021-Cryptographic Failures) - #2

## Description

Many communication channels can be sniffed by attackers during data transmission. When sensitive data is transmitted without encryption, an attacker can intercept and read this information. Secure channels like TLS should be used to protect sensitive data in transit.

## Prevention

### Go

Use StartTLS instead of Start to enable HTTPS encryption

Use ListenTLS instead of Listen to enable HTTPS encryption

Use RunTLS instead of Run to enable HTTPS encryption

## Consequences

- Ler dados da aplicação
- Burlar mecanismo de proteção

## Mitigations

- Criptografe todos os dados sensíveis antes da transmissão
- Use TLS/SSL para todas as conexões que transmitem dados sensíveis
- Implemente certificate pinning em aplicações móveis

## Detection

- Total rules: 6
- Languages: go, kubernetes, yaml, python

## Rules by Language

### Go (3 rules)

- **Echo Running Without TLS** [HIGH]: Echo server running over HTTP instead of HTTPS.
  - Remediation: Use StartTLS with certificate files for HTTPS.

```go
e := echo.New()
e.StartTLS(":443", "cert.pem", "key.pem")
```

Learn more: https://shoulder.dev/learn/go/cwe-319/tls-config
- **Fiber Running Without TLS** [HIGH]: Fiber server running over HTTP instead of HTTPS.
  - Remediation: Use ListenTLS with certificate files for HTTPS.

```go
app := fiber.New()
app.ListenTLS(":443", "cert.pem", "key.pem")
```

Learn more: https://shoulder.dev/learn/go/cwe-319/tls-config
- **Gin Running Without TLS** [LOW]: Gin server running over HTTP instead of HTTPS.
  - Remediation: Use RunTLS with certificate files for HTTPS.

```go
r := gin.Default()
r.RunTLS(":443", "cert.pem", "key.pem")
```

Learn more: https://shoulder.dev/learn/go/cwe-319/tls-config