CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
How it's found
Use of Hard-coded Cryptographic Key is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Consequences
- Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data: If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Mitigations
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
How TurboPentest tests for this (white-box)
This weakness (Use of Hard-coded Cryptographic Key) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 32 rules for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is CWE-321?
The product uses a hard-coded, unchangeable cryptographic key.
How do you find Use of Hard-coded Cryptographic Key?
Use of Hard-coded Cryptographic Key is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-321?
Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data: If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Does TurboPentest test for Use of Hard-coded Cryptographic Key?
This weakness (Use of Hard-coded Cryptographic Key) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 32 rules for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
- Base weaknessCWE-798: Use of Hard-coded Credentials
- Variant weaknessCWE-14: Compiler Removal of Code to Clear Buffers
- Base weaknessCWE-261: Weak Encoding for Password
- Class weaknessCWE-311: Missing Encryption of Sensitive Data
- Base weaknessCWE-325: Missing Cryptographic Step
- Class weaknessCWE-326: Inadequate Encryption Strength
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest