CWE-317 applies when a product stores sensitive information in cleartext within the GUI. The platform list on MITRE includes Windows, where desktop interface objects such as windows and menus can be queried by other programs.
How it happens
A masked password box shows dots, but the text underneath is still stored in the control. MITRE notes that an attacker can often get data from a GUI, even when it is hidden, by using an API to directly access GUI objects such as windows and menus. Encoding does not help either, since techniques exist to identify and reverse it.
The same holds for dialogs that keep a password in a hidden field, or an interface that preloads a secret into a text control so the user does not have to retype it.
The observed example is CVE-2002-1848: unencrypted passwords stored in a GUI dialog may allow local users to access the passwords.
What an attacker gains
The listed consequences are loss of confidentiality, by reading memory and application data. The attacker is usually a local user or a program running on the same machine.
How to find it
The record lists no detection methods. Practical checks:
- Use a UI inspection tool on your own application and look at the properties of password and token controls.
- Look for code that fills a field with a stored secret.
- Check whether the window or dialog is left open, and whether the field is cleared after use.
How to fix it
The record lists no formal mitigations. Sensible steps:
- Do not prefill sensitive fields with real values. Show a placeholder, and ask for re-entry when the value must change.
- Clear the control as soon as the secret has been used.
- Keep the secret out of the interface layer entirely, in a protected store, and refer to it by handle.
- Treat masking as a display feature, not as protection.
Quick check
If the field shows only dots, is the data protected?
No. The dots are only drawn on screen. The underlying text can often be read through interface APIs.
