DerScanner
Home / Vulnerability Database / T-SQL : Null encryption key
T-SQL

T-SQL : Null encryption key

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP MASVS
V3: 3.3.(L1/L2/L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored Cryptography
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (e)(1)
CWE
CWE-321

Overview

The encryption key with a value of NULL can result in an application compromise.

You should never use a null encryption key, since it significantly reduces the protection afforded by a good encryption algorithm, but also makes fixing the problem difficult. Information that it uses a null key encryption is accessible to at least every developer of the application. After the application is installed, the null encryption key can not be removed without updating the software. If an account that is protected by a null encryption key is compromised, system administrators will be forced either to neglect the safety, or to restrict the access to the application. Constant strings are easily extracted from the compiled application by decompilers. Therefore, it is not necessary for an attacker to have access to the source code, to determine that a null encryption key is used.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. Use of hard-coded password
  2. CWE-321: Use of Hard-coded Cryptographic Key
  3. OWASP Top 10 2013-A5-Security Misconfiguration
  4. OWASP Top 10 2013-A6-Sensitive Data Exposure
  5. OWASP Top 10 2017-A3-Sensitive Data Exposure
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
MEDIUM

DerScanner Severity Score

Do you want to fix T-SQL : Null encryption key in your application?

See also

T-SQL

T-SQL : Weak encryption algorithm

T-SQL

T-SQL : Weak hashing algorithm

T-SQL

T-SQL : Weak random number generator