DerScanner
Home / Vulnerability Database / Rust : Hardcoded encryption key
Rust

Rust : Hardcoded encryption key

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP MASVS
V2: 2.2.(L1/L2/L1+R/L2+R)V2: 2.14.(L2/L2+R)V3: 3.1.(L1/L2/L1+R/L2+R)V8: 8.11.(L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored CryptographyStored CryptographyStored CryptographySession ManagementAuthentication
PCI DSS 4.0
3.7.36.5.66.2.48.3.2
HIPAA
§164.312 (e)(1)
CWE
CWE-257CWE-321CWE-798
CWE/SANS Top 25 2011
CWE-798
CWE/SANS Top 25 2021
CWE-798

Overview

Hardcoded encryption key can lead to the application data being compromised.

Eliminating the security risks related to keys being specified in the source code is extremely difficult. Such keys are available at least to every developer of the application. Moreover, after the application is installed, removing the key from its code is possible only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have access to the source code to find out the value of the key.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP: Use of hard-coded cryptographic key
  2. CWE-321: Use of Hard-coded Cryptographic Key
  3. OWASP Top 10 2013-A5-Security Misconfiguration
  4. OWASP Top 10 2013-A6-Sensitive Data Exposure
  5. OWASP Top 10 2017-A3-Sensitive Data Exposure
CRITICAL

DerScanner Severity Score

Do you want to fix Rust : Hardcoded encryption key in your application?

See also

Rust

Rust : Buffer overflow

Rust

Rust : Empty salt

Rust

Rust : Hardcoded salt