CWE-258 is about as plain as weaknesses get. Using an empty string as a password is insecure.
How it happens
A default config ships with password= and a comment saying "set this". A developer sets up a local database with no password to save time and commits the file. A container image gets built with the same settings. Nobody revisits it.
# Vulnerable: empty password in a config file
db.user=app
db.password=
# Better: no secret in the file at all
db.user=app
db.password=${DB_PASSWORD}
The second form reads the value from the environment or a secret manager at startup, and the app should refuse to start if it is missing or blank.
MITRE's observed example is CVE-2022-26117: a network access control product had a configuration file with an empty password.
What an attacker gains
The record lists access control: gaining privileges or assuming an identity. Anyone who can reach the service can log in as the account.
How to find it
The record lists no detection methods. Easy checks:
- Search config files, templates and images for blank password keys.
- Add a startup check that rejects empty credentials.
- Run a secrets scan in CI so blank and committed credentials are caught before release.
How to fix it
MITRE's guidance, under System Configuration, is about choosing passwords: at least eight characters, the longer the better; avoid words found in a dictionary, a names book or on a map; avoid passwords similar to others you use; include numbers or punctuation, but avoid obvious substitutions such as c@t. It is never appropriate to use an empty string as a password.
For software, also enforce those rules in code, generate a unique credential at install time instead of shipping a blank one, and keep the secret out of the config file.
Where blank passwords come from
Blank passwords usually arrive for ordinary reasons. A sample config ships with an empty field to be filled in later. A test environment is set up without a password to save time, and the same file is reused. An installer creates an account and leaves its password unset.
Two defenses catch most of them. First, make the application check its own configuration at startup, and refuse to run when a required credential is empty. Second, make blank values impossible to ship: generate a unique credential during installation, or force the administrator to set one on first use.
Review default and example configuration the same way you review code. The observed example in a network access control product is a reminder that a security product can ship with the weakness it is meant to prevent.
Quick check
Is an empty password ever acceptable?
MITRE says it is never appropriate to use an empty string as a password.
