GBhatnagar521131 (Community Member) asked a question.

August 8, 2023 at 8:59 AM
How to FIX Use of Hard-coded Password (CWE ID 259)(8 flaws) in C# code where Google Drive App ID (.p12) file is loaded?

I performed a Veracode scan on my Windows EXE. It reported following security vulnerabilities on the code in BOLD below:

 

Use of Hard-coded Password (CWE ID 259)(8 flaws)

 

  string GoogleSecID = AppDomain.CurrentDomain.BaseDirectory

                 + Global.AppSettings("GoogleDriveAppIDFileName");

 X509Certificate2 certificate = null;

      try

      {

        string appconfigValue = Global.AppSettings("GoogleAppServiceAccountSecret");

       certificate = new X509Certificate2(GoogleSecID, appconfigValue, X509KeyStorageFlags.Exportable);

 

How do I fix it ?

 

Thanks, Gagan

  • 2 answers
  • 2.88K views

  • Kashif, Security Consultant (Veracode inc)

    Hi @GBhatnagar521131 (Community Member)​ 

     

    The flaw CWE 259 is flagged for hardcoded string assignment to Password-like variable. I do not see reason of flagging for the line(bold). Can you confirm the attack vector of the Flaw. Review the description of the flaw in 'Triage Flaws' of the scan, by clicking the small arrow next to the checkbox in first column of the particular flaw.

    Attack vectors helps refer to the line, and the variable which has a hardcoded value assigned. If you identify the variable and value is not actual password or any secret value, you can raise mitigation as False Positive. If you like to review it with Veracode consultant, I would recommend you schedule a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

     

    Regards,

    Kashif.

     

    Expand Post

Topics (8)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.