rPathak406496 (Community Member) asked a question.
Fix for Insertion of Sensitive Information Into Sent Data (CWE ID 201) ?
In below code snippet , we are passing only what is required to call the api and
_apiUrl,_clientId,_clientSecret,audience,_grantType is being fetched from web config file.
var response = Client.PostAsJsonAsync(_apiUrl, new
{
client_id = _clientId,
client_secret = _clientSecret,
audience = audience,
grant_type = _grantType
}).GetAwaiter().GetResult();
Not sure why veracode reported this as CWE ID 201 . please suggest what fix can be applied here .
.png){kind=logo}
Hi @rPathak406496 (Community Member) ,
Veracode Static Analysis reports CWE 201 (Insertion of Sensitive Information Into Sent Data) when it detects that potentially sensitive data (from a known place of sensitive information such as the configuration) is sent out of the application. The concerns being that the sent-out information might be sensitive in itself (such as credentials or private messages) or an attacker might be able to leverage the information for further attacks.
The question we will ask is: Whether this data is really sensitive or not. The scanner might be wrongly identifying it but is basically giving us all an opportunity to review if we may be passing any sensitive data. The scanner usually refers to configuration or properties as "Sensitive", so it is best we review each of such properties used in the flagged code.
If there is no sensitive data or the sensitive data is used correctly, please feel free to propose mitigation (refer: https://help.veracode.com/r/improve_mitigation) by explaining which config or environmental variables are used and why you think they are not sensitive at all. If they are sensitive, ensure that the transfer of that sensitive data is intended and that it does not violate the application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema