CWE-541, Inclusion of Sensitive Information in an Include File, is a configuration hygiene problem. MITRE's description: if an include file's source is accessible, the file can contain usernames and passwords as well as sensitive information about the application and the system.
How it happens
Many web platforms let you split code into shared pieces that other files pull in. Developers like to put database settings in one such file so every page can reuse it. That is convenient, and it also concentrates your secrets in one place.
The risk appears when the web server returns that file's source rather than running it. A misconfigured extension mapping, a backup copy, or a file placed in a public folder can all do it.
What an attacker gains
MITRE lists reading application data as the confidentiality impact. A database include is a ready-made set of credentials and often names the host and schema as well.
How to find it
- List the include files in your project and see which are inside publicly served directories.
- Request each one by URL on a test system and see whether source is returned.
- Search include files for
password,userand connection strings.
How to fix it
MITRE gives two design level steps:
- Do not store sensitive information in include files.
- Protect include files from being exposed, through design and system configuration.
In practice, load secrets from the environment or a secrets store, and keep shared code outside the document root so a URL cannot reach it.
Quick check
Why not just rely on the file being executed rather than displayed?
Because a configuration mistake can flip that behavior. If the secret is not in the file, a mistake costs you nothing.
