CWE-319, Cleartext Transmission of Sensitive Information, is what happens when a product sends sensitive or security critical data over a channel that unauthorized actors can sniff, and does not encrypt it first.
It affects web apps, mobile apps, APIs, internal services and, as the observed examples show, industrial devices. Anywhere two systems talk, this weakness can sit between them.
How it happens
Most cases fall into a few patterns:
- A service listens on plain HTTP, or a protocol that has no encryption at all.
- Login happens over TLS but the rest of the session does not. MITRE specifically advises using SSL for the entire session, from login to logout, not just the initial login page.
- A client falls back to an unencrypted connection when the secure one fails.
- Internal traffic is assumed safe because it stays inside the network.
A vulnerable pattern in Python:
# Vulnerable: credentials travel in cleartext
requests.post("http://api.example.com/login",
data={"user": user, "password": pw})
The fix is one character in the URL, plus making sure the server refuses plain connections:
# Fixed: encrypted channel, certificate verified by default
requests.post("https://api.example.com/login",
data={"user": user, "password": pw})
The observed CVEs for this weakness are mostly controllers. CVE-2022-29519 and CVE-2022-31204 describe programmable logic controllers that send passwords, and in the first case session tokens, in plaintext. CVE-2022-30312 is a building controller using a protocol that transmits authentication credentials in plaintext. CVE-2002-1949 is a plain case of passwords sent in cleartext.
What an attacker gains
Anyone who can reach the channel can read what crosses it. MITRE notes that many channels can be sniffed, and that in networking, packets can be captured as they pass. The record lists effects on both confidentiality and integrity: reading application data and modifying files or directories.
There is a second, quieter risk. When full communications are recorded or logged, such as in a packet dump, an adversary can obtain the dump long after the transmission and extract the cleartext from it. Data you sent last year can still be exposed.
How to find it
MITRE lists these detection methods:
- Black box monitoring. Use tools that watch the software's process as it interacts with the operating system and the network. This works when you have no source code, when someone else wrote the software, or when you want to confirm the build did not introduce a problem.
- Automated static analysis. SAST can find some instances by analyzing source or compiled code and modeling data flow.
- Manual testing. Penetration testing, threat modeling and interactive tools that let a tester record and modify a live session can find design and business rule problems that automation misses.
A simple check you can do today: capture traffic from your app on a test machine and search the capture for a known test password.
How to fix it
MITRE's mitigations, in plain steps:
- Before transmitting, encrypt the data with reliable, confidentiality protecting cryptographic protocols.
- For web applications, use SSL or TLS for the entire session.
- On hardware platforms, ensure approved encryption algorithms, such as those recommended by NIST, protect the paths from security critical data to trusted user applications.
- Configure servers to use encrypted channels for communication.
- Test with human led techniques as well as tools, especially for weaknesses tied to design.
In practice, also redirect or refuse plain HTTP, and do not allow clients to downgrade silently.
Try it yourself
Dynamic scanning is one way to catch services that answer on the wrong channel. This demo walks through a web app scan.
Click through it at your own pace, or open it full screen.
Quick check
Is it enough to protect only the login page?
No. Session tokens and data sent after login are also sensitive. Use encryption for the whole session.
Why does a packet dump matter years later?
If it holds cleartext, anyone who obtains the dump can read it, whenever the traffic happened.
