#2
A02:2021
Cryptographic Failures
Failures related to cryptography which often lead to sensitive data exposure. This was previously known as Sensitive Data Exposure.
概述
Shifting up one position to #2, previously known as Sensitive Data Exposure. The focus is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Data exposure in transit
Sensitive data transmitted over unencrypted connections can be intercepted. This includes passwords, session tokens, and personal information.
检测信号:
HTTP (not HTTPS) requests containing authentication data or sensitive information
Weak cryptographic storage
Data stored with weak or broken encryption (MD5, SHA1, DES) can be recovered by attackers who gain database access.
检测信号:
Database dumps containing hashed passwords with known weak algorithms
如何预防
- Classify data processed, stored, or transmitted by an application
- Don't store sensitive data unnecessarily
- Encrypt all sensitive data at rest
- Use up-to-date and strong standard algorithms and protocols
- Encrypt all data in transit with secure protocols such as TLS
- Disable caching for responses containing sensitive data
- Store passwords using strong salted hashing functions
有Shoulder检测的CWE (8)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
CWE-319
6 规则
Cleartext Transmission of Sensitive Information
go, kubernetes, yaml, python
CWE-327
4 规则
Use of a Broken or Risky Cryptographic Algorithm
go, javascript, typescript, python
CWE-338
4 规则
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
go, javascript, typescript, python
CWE-347
1 严重
4 规则
Improper Verification of Cryptographic Signature
python, go, javascript, typescript
CWE-326
2 规则
Inadequate Encryption Strength
python
CWE-916
2 规则
Use of Password Hash With Insufficient Computational Effort
javascript, typescript, python
CWE-321
1 严重
1 规则
Use of Hard-coded Cryptographic Key
javascript, typescript
CWE-330
1 规则
Use of Insufficiently Random Values
go
其他映射的CWE (22)
这些CWE映射到此类别，但尚无Shoulder规则。
CWE-261
CWE-261
CWE-296
CWE-296
CWE-310
CWE-310
CWE-322
CWE-322
CWE-323
CWE-323
CWE-324
CWE-324
CWE-325
CWE-325
CWE-328
CWE-328
CWE-329
CWE-329
CWE-331
CWE-331
CWE-335
CWE-335
CWE-336
CWE-336
CWE-337
CWE-337
CWE-339
CWE-339
CWE-340
CWE-340
CWE-523
CWE-523
CWE-720
CWE-720
CWE-757
CWE-757
CWE-759
CWE-759
CWE-760
CWE-760
CWE-780
CWE-780
CWE-818
CWE-818