CWE-314 covers products that store sensitive information in cleartext in the registry. It mainly concerns Windows software that keeps its settings there.
How it happens
The registry is a convenient place for application settings, so credentials end up next to them. An installer asks for a service account password and saves it in a key. A sync tool remembers a login the same way.
MITRE says attackers can read the information by accessing the registry key. As with other cleartext entries, encoding is not protection: techniques exist to work out the encoding and decode the data.
The observed example is CVE-2005-2227, which involved cleartext passwords in a registry key.
What an attacker gains
The listed consequence is loss of confidentiality, by reading application data.
How to find it
The record lists no detection methods. Practical checks:
- Export the keys your product creates and search the values for passwords, tokens and connection strings.
- Review key permissions to see which accounts can read them.
- Search source for registry write calls and check what values they store.
How to fix it
The record has no formal mitigations. Sound practice:
- Do not store passwords in the registry. Ask for credentials when needed, or use the operating system's credential facilities.
- If the product must keep a secret, encrypt it with an OS-provided mechanism so only the intended account can recover it.
- Restrict permissions on any key that holds sensitive settings.
- Migrate old installs by removing existing cleartext values during upgrade.
Quick check
Does a hidden or obscure key name protect the value?
No. Anyone who can read the registry can enumerate keys, so obscurity adds nothing.
