CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
How it's found
Use of Hard-coded Cryptographic Key is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Consequences
- Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data: If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Mitigations
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
How TurboPentest tests for this (white-box)
This weakness (Use of Hard-coded Cryptographic Key) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 32 rules for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is CWE-321?
The product uses a hard-coded, unchangeable cryptographic key.
How do you find Use of Hard-coded Cryptographic Key?
Use of Hard-coded Cryptographic Key is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-321?
Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data: If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Does TurboPentest test for Use of Hard-coded Cryptographic Key?
This weakness (Use of Hard-coded Cryptographic Key) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 32 rules for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
- Base weaknessCWE-798: Use of Hard-coded Credentials
- Variant weaknessCWE-14: Compiler Removal of Code to Clear Buffers
- Base weaknessCWE-261: Weak Encoding for Password
- Class weaknessCWE-311: Missing Encryption of Sensitive Data
- Base weaknessCWE-325: Missing Cryptographic Step
- Class weaknessCWE-326: Inadequate Encryption Strength
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest