Home / Vulnerability Database / C-sharp : Hardcoded encryption key
C#
C-sharp : Hardcoded encryption key
Classification
OWASP Top 10 2013
OWASP Top 10 2017
OWASP Top 10 2021
OWASP MASVS
HIPAA
CWE/SANS Top 25 2011
Overview
Key is explicitly defined in the source code. This may lead to an application data compromise.
Eliminating the security risks related to keys being specified in the source code is extremely difficult. Such keys are available at least to every developer of the application. Moreover, after the application is installed, removing the key from its code is possible only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have access to the source code to find out the value of the key.
Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.
References
- Use of hard-coded password
- CWE-259: Use of Hard-coded Password
- OWASP Top 10 2013-A5-Security Misconfiguration
- OWASP Top 10 2013-A6-Sensitive Data Exposure
- OWASP Top 10 2017-A3-Sensitive Data Exposure
- CWE-321
- CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
- CWE-798: Use of Hard-coded Credentials
MEDIUM
DerScanner Severity Score
Do you want to fix C-sharp : Hardcoded encryption key in your application?
See also
C#
C-sharp : JWT: None Algorithm
C#
C-sharp : Insecure data transmission: Database
C#