CWE-922, Insecure Storage of Sensitive Information, is a broad class: the product stores sensitive information without properly limiting read or write access by unauthorized actors. Almost every application stores something sensitive, so almost every team can hit it.
How it happens
MITRE separates two failures. If read access is not restricted, attackers can steal the data. If write access is not restricted, they can modify or delete it, which leads to incorrect results and possibly denial of service.
Typical places: cookies, local files, config files checked into a repository, mobile device storage, browser storage, backups and logs. The one observed CVE in the record, CVE-2009-2272 (details), stored a password and username in cleartext in a cookie. The browser then carried credentials on every request and left them readable on disk.
# Weak: credentials in a cookie, readable by anyone with the cookie
response.set_cookie("auth", f"{username}:{password}")
# Better: store only an opaque session id, keep the data server side
response.set_cookie("sid", new_session_id(), httponly=True, secure=True)
What an attacker gains
From the MITRE consequences: confidentiality, because attackers read sensitive information by accessing the unrestricted storage; integrity, because they can overwrite or delete it.
How to find it
MITRE says automated static analysis (SAST) can find some instances by modeling data flow and control flow, rating it high effectiveness. Checks you can run today:
- Search the repository and its history for passwords, tokens and keys.
- List file permissions on directories where the app writes data.
- Inspect cookies, local storage and mobile app storage after login.
- Read logs for values that should never be logged.
How to fix it
The record lists no formal mitigations. Practical steps that follow from the weakness:
- Do not store sensitive data client side when the server can hold it.
- Set restrictive permissions on files and directories that hold sensitive data, and use the storage access control the platform provides.
- Keep secrets out of source control and load them from a secret store at runtime.
- Protect backups with the same access limits as the live data.
Try it yourself
The demo shows how a scanner finds secrets before they ship.
Click through it at your own pace, or open it full screen.
Quick check
What are the two ways storage can be insecure?
Unrestricted read access lets attackers steal data. Unrestricted write access lets them change or delete it.
Is a cleartext cookie really storage?
Yes. The browser stores it, and the observed CVE-2009-2272 is exactly this case.
