CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How it's found
Insufficiently Protected Credentials describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Consequences
- Gain Privileges or Assume Identity: An attacker could gain access to user accounts and access sensitive data used by the user accounts.
Mitigations
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
How TurboPentest tests for this (white-box)
This weakness (Insufficiently Protected Credentials) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 11 rules for it, flagging the issue directly in your source code as part of the pentest.
- Basic Auth Header Literal
- Connection String Embedded Creds
- Hardcoded API Key Token
- Basic Auth Credentials In URL
- Secret Hardcoded Setter
- Basic Auth Credentials In URL
- DB Connection String With Credentials
- Hardcoded Credential String
- Basic Auth Credentials In URL
- Basic Auth In URL
- DB Connection String Credentials
Frequently asked questions
What is CWE-522?
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How do you find Insufficiently Protected Credentials?
Insufficiently Protected Credentials describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-522?
Gain Privileges or Assume Identity: An attacker could gain access to user accounts and access sensitive data used by the user accounts.
Does TurboPentest test for Insufficiently Protected Credentials?
This weakness (Insufficiently Protected Credentials) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 11 rules for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
- Class weaknessCWE-1390: Weak Authentication
- Class weaknessCWE-287: Improper Authentication
- Class weaknessCWE-668: Exposure of Resource to Wrong Sphere
- Variant weaknessCWE-259: Use of Hard-coded Password
- Base weaknessCWE-301: Reflection Attack in an Authentication Protocol
- Base weaknessCWE-309: Use of Password System for Primary Authentication
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest