chethan (Community Member) asked a question.
Hi,
I'm looking for some suggestions on resolving CWE-256.
Original Code:
dbProps = new Properties();
con = DriverManager.getConnection(jUrl,jUser, dbProps.get('pwd'));
Veracode suggestion: Never store sensitive data in plaintext. Consider using cryptographic hashes as an alternative to plaintext.
So I started using jasypt library which helps to encrypt the password in a property file and use that instead of plaintext. Here's the modified code.
Modified Code:
StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
encryptor.setPassword(propFilePassword);
dbProps = new EncryptableProperties(encryptor);
con = DriverManager.getConnection(jUrl,jUser, dbProps.get('pwd'));
I still see the issue in the Veracode scan.
Should this be mitigated by design? or Is there a mistake in approaching this vulnerability? Please advise.
.png){kind=logo}
HI @chethan (Community Member) ,
Veracode Static Analysis reports a flaw of CWE 256 when it can see that a connection is being created with data from a properties file. The concern is that these sensitive credentials are not adequately protected.
Veracode Static Analysis currently does not support automatic detection by using an encryption library such as jasypt. Properly managed this can be a good way to guard sensitive credentials and a good basis for a manual mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) which you can discuss with your security team.
Alternatively, Veracode Static Analysis will automatically close the flaw if you switch to an alternate way of connecting such as Data Sources: https://docs.oracle.com/javase/tutorial/jdbc/basics/sqldatasources.html .
In general, use of Data Sources is preferred and recommended both by Oracle and Veracode Application Security Consulting.
Thank you,
Boy Baukema