CWE-1394 covers a product that uses a default cryptographic key for potentially critical functionality.
Anyone who ships software, appliances or firmware with a built in key should pay attention, and so should anyone who deploys them.
How it happens
Default keys make manufacturing and installation simpler. If administrators do not change them, an attacker can bypass authentication quickly across multiple organizations, because the same key opens every door.
The record's examples show three flavors:
- CVE-2018-3825: a cloud cluster management product with a default master encryption key.
- CVE-2016-1561: a backup storage product with a default SSH public key in authorized_keys, allowing root access.
- CVE-2010-2306: an intrusion detection system using the same static private SSL keys across devices and installations, which allowed decryption of SSL traffic.
What an attacker gains
MITRE lists authentication consequences: gaining privileges or assuming identity. The SSL example also shows the confidentiality angle, since a shared private key lets whoever holds it read the traffic.
How to find it
The record gives no detection methods. Search repositories and firmware images for private keys and key files. Check whether two installs of your product produce the same key material. Our secrets scanning demo shows what that kind of search looks like.
Click through it at your own pace, or open it full screen.
How to fix it
MITRE's mitigations:
- Prohibit default, hard coded or other values that do not vary per installation, especially across separate organizations. Effectiveness: high.
- Force the administrator to change the credential at installation. Effectiveness: high.
- Let the administrator change defaults at install or during operation. Effectiveness: moderate.
For keys, the clean way to meet the first rule is to generate a fresh key per installation on first run.
Quick check
Why is a shared private key so damaging?
Anyone who obtains it from one device can use it against every device that shares it, as the IDS example in the record shows.
