Home / Vulnerability Database / Kotlin : Empty encryption key in JWT-token signature
Kotlin
Kotlin : Empty encryption key in JWT-token signature
Classification
OWASP Top 10 2013
OWASP Top 10 2017
OWASP Top 10 2021
OWASP ASVS
HIPAA
CWE
Overview
An empty key may lead to an application compromise.
It is very difficult to eliminate the security risks related to hardcoded empty keys. The fact that some data is encrypted with an empty key is at least known to every application developer. Moreover, after the application is installed, the empty key can be removed from the code only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have an access to the source code to learn about the encryption with an empty key.
Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.
References
- Use of hard-coded password
- CWE-259: Use of Hard-coded Password
- OWASP Top 10 2013-A5-Security Misconfiguration
- OWASP Top 10 2013-A6-Sensitive Data Exposure
- OWASP Top 10 2017-A3-Sensitive Data Exposure
- Hacking JSON Web Tokens (JWTs) - The Startup
- CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
CRITICAL
DerScanner Severity Score
Do you want to fix Kotlin : Empty encryption key in JWT-token signature in your application?
See also
Kotlin
Kotlin : Missing required cryptographic step
Kotlin
Kotlin : Logging into system output
Kotlin