CWE-1391 Use of Weak Credentials: Four Ways Secrets Go Bad

CWE-1391, Use of Weak Credentials, covers products that use credentials such as a default key or hard coded password that can be calculated, derived, reused or guessed by an attacker.

It matters most for anyone shipping software or devices that others deploy, and for anyone running them.

How it happens

Authentication protocols are built so that an attacker without the credential has to brute force it. Weak credentials remove that barrier. If the value is predictable or fixed, the attacker simply uses it.

MITRE lists four ways a credential ends up weak:

• Hard coded. Static and not changeable by the administrator.
• Default. The same value across deployments, though an administrator could change it.
• Predictable. Unique per installation, but generated in a way that can be guessed with reasonable effort.
• Previously compromised. Leaked in a data breach and now on someone's list.

The record's examples include an RTU using default SSH credentials (CVE-2022-30270), a distributed control system that uses a deterministic algorithm to generate utility passwords (CVE-2022-29965), and an RTU with a hard coded SSH private key likely to be reused across typical deployments (CVE-2022-30271). It also lists a JavaScript cryptocurrency library that could fall back to the insecure Math.random() instead of reporting a failure, which reduces entropy.

What an attacker gains

MITRE's consequence is access control: an adversary could bypass the intended authentication restrictions. In practice that means taking whatever the credential protects.

How to find it

The record lists no detection methods. Practical checks:

1. Search source and config for passwords, keys and tokens committed to the repository.
2. Look at how credentials are generated. Anything derived from time, a counter or a device identifier deserves suspicion.
3. Confirm random values come from a cryptographically secure source and that failure to get one stops the operation rather than falling back.
4. Check user passwords against known breached lists.

How to fix it

From the record, the mitigation is to check a password against a database of already compromised or breached passwords when a user sets or changes it, at design time and in operation. MITRE rates its effectiveness as moderate, since those passwords are the ones most likely to be tried in guessing attacks.

For the fixed and default cases, the sibling entries on default credentials add useful guidance: do not ship values that are the same across installations, and force a change at install time.

Quick check

Sources

• MITRE CWE-1391