What is Cleartext Storage of Sensitive (CWE-312)?

TL;DR: Cleartext Storage of Sensitive Information (CWE-312) is a type of Insecure Design vulnerability that occurs when sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. To prevent this vulnerability, use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls.

At-a-Glance

What is Cleartext Storage of Sensitive Information?

Cleartext Storage of Sensitive Information (CWE-312) is a type of Insecure Design vulnerability that occurs when sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. As defined by the MITRE Corporation under CWE-312, and classified by the OWASP Foundation under A06:2025 - Insecure Design, this vulnerability can have severe consequences if left unaddressed.

Quick Summary

Cleartext Storage of Sensitive Information (CWE-312) is a critical security vulnerability that occurs when sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. This vulnerability can lead to unauthorized access to sensitive data, resulting in financial loss, reputational damage, and compliance issues. To prevent this vulnerability, use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls.

Jump to: Quick Summary · Cleartext Storage of Sensitive Information Overview · How Cleartext Storage of Sensitive Information Works · Business Impact of Cleartext Storage of Sensitive Information · Cleartext Storage of Sensitive Information Attack Scenario · How to Detect Cleartext Storage of Sensitive Information · How to Fix Cleartext Storage of Sensitive Information · Framework-Specific Fixes for Cleartext Storage of Sensitive Information · How to Ask AI to Check Your Code for Cleartext Storage of Sensitive Information · Cleartext Storage of Sensitive Information Best Practices Checklist · Cleartext Storage of Sensitive Information FAQ · Vulnerabilities Related to Cleartext Storage of Sensitive Information · References · Scan Your Own Site

Cleartext Storage of Sensitive Information Overview

What

Cleartext Storage of Sensitive Information (CWE-312) is a type of Insecure Design vulnerability that occurs when sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.

Why it matters

Unauthorized access to sensitive data can lead to financial loss, reputational damage, and compliance issues. Proper encryption-at-rest mechanisms must be used to prevent this vulnerability.

Where it occurs

Cleartext Storage of Sensitive Information (CWE-312) can occur in cloud storage, databases, and web applications.

Who is affected

Any organization that stores sensitive information in cleartext within a resource that might be accessible to another control sphere is at risk of being affected by this vulnerability.

Who is NOT affected

Organizations that use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls are not affected by this vulnerability.

How Cleartext Storage of Sensitive Information Works

Root Cause

The root cause of Cleartext Storage of Sensitive Information (CWE-312) is the storage of sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack Flow

1. An attacker gains access to a resource that stores sensitive information in cleartext.
2. The attacker accesses the sensitive information, which can lead to unauthorized access and exploitation.

Prerequisites to Exploit

• Sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.
• The resource is not properly secured with encryption-at-rest mechanisms.

Vulnerable Code

import os

# vulnerable code: storing sensitive information in cleartext
sensitive_info = "password123"
with open("config.txt", "w") as f:
    f.write(sensitive_info)

The above code stores the password “password123” in plain text within a file called “config.txt”. This is an example of Cleartext Storage of Sensitive Information (CWE-312).

Secure Code

import os
from cryptography.fernet import Fernet

# secure code: using encryption-at-rest mechanisms
sensitive_info = "password123"
key = Fernet.generate_key()
cipher_suite = Fernet(key)
encrypted_info = cipher_suite.encrypt(sensitive_info.encode())
with open("config.txt", "wb") as f:
    f.write(encrypted_info)

The above code uses the cryptography library to encrypt the sensitive information using a key generated by Fernet.generate_key(). The encrypted data is then stored in the file “config.txt”.

Business Impact of Cleartext Storage of Sensitive Information

Confidentiality

Cleartext Storage of Sensitive Information (CWE-312) can lead to unauthorized access to sensitive information, resulting in confidentiality breaches.

• Financial loss: Unauthorized access to sensitive information can result in financial loss due to theft or misuse of sensitive data.
• Reputational damage: Breaches of confidentiality can damage an organization’s reputation and erode customer trust.
• Compliance issues: Organizations may face compliance issues if they fail to protect sensitive information in accordance with relevant regulations.

Integrity

Cleartext Storage of Sensitive Information (CWE-312) can lead to unauthorized modification of sensitive information, resulting in integrity breaches.

• Financial loss: Unauthorized modification of sensitive information can result in financial loss due to theft or misuse of sensitive data.
• Reputational damage: Breaches of integrity can damage an organization’s reputation and erode customer trust.
• Compliance issues: Organizations may face compliance issues if they fail to protect sensitive information in accordance with relevant regulations.

Availability

Cleartext Storage of Sensitive Information (CWE-312) can lead to denial-of-service attacks, resulting in availability breaches.

• Financial loss: Denial-of-service attacks can result in financial loss due to downtime and lost productivity.
• Reputational damage: Breaches of availability can damage an organization’s reputation and erode customer trust.
• Compliance issues: Organizations may face compliance issues if they fail to protect sensitive information in accordance with relevant regulations.

Cleartext Storage of Sensitive Information Attack Scenario

1. An attacker gains access to a resource that stores sensitive information in cleartext.
2. The attacker accesses the sensitive information, which can lead to unauthorized access and exploitation.

How to Detect Cleartext Storage of Sensitive Information

Manual Testing

• Review code for storage of sensitive information in cleartext.
• Check if encryption-at-rest mechanisms are used.
• Verify that access controls are properly configured.

Automated Scanners (SAST/DAST)

Automated scanners can detect Cleartext Storage of Sensitive Information (CWE-312) by analyzing code for storage of sensitive information in cleartext and checking if encryption-at-rest mechanisms are used. However, dynamic analysis may be required to determine if the resource is properly secured.

PenScan Detection

PenScan’s automated scan engines actively test for this issue, helping you identify and fix vulnerabilities before they’re exploited.

False Positive Guidance

When reviewing findings of Cleartext Storage of Sensitive Information (CWE-312), consider the following:

• If the pattern looks risky but is actually safe due to context a scanner can’t see, it may be a false positive.
• Verify that encryption-at-rest mechanisms are used and access controls are properly configured.

How to Fix Cleartext Storage of Sensitive Information

Use Encryption-At-Rest Mechanisms

Use database column encryption or cloud storage provider controls to protect sensitive information from unauthorized access.

Regularly Review and Update Access Controls

Regularly review and update access controls to ensure only authorized personnel can access sensitive data.

Framework-Specific Fixes for Cleartext Storage of Sensitive Information

C/C++

#include <stdio.h>
#include <string.h>

// vulnerable code: storing sensitive information in cleartext
char* sensitive_info = "password123";
strcpy(password, sensitive_info);

The above code stores the password “password123” in plain text. This is an example of Cleartext Storage of Sensitive Information (CWE-312).

#include <stdio.h>
#include <string.h>

// secure code: using encryption-at-rest mechanisms
char* sensitive_info = "password123";
key = Fernet.generate_key();
cipher_suite = Fernet(key);
encrypted_info = cipher_suite.encrypt(sensitive_info.encode());
strcpy(password, encrypted_info);

The above code uses the cryptography library to encrypt the sensitive information using a key generated by Fernet.generate_key(). The encrypted data is then stored in memory.

Java

import java.security.Key;
import javax.crypto.Cipher;

// vulnerable code: storing sensitive information in cleartext
String sensitiveInfo = "password123";
byte[] encryptedBytes = Cipher.getInstance("AES").encrypt(sensitiveInfo.getBytes());

The above code stores the password “password123” in plain text. This is an example of Cleartext Storage of Sensitive Information (CWE-312).

import java.security.Key;
import javax.crypto.Cipher;

// secure code: using encryption-at-rest mechanisms
String sensitiveInfo = "password123";
Key key = KeyGenerator.getInstance("AES").generateKey();
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.ENCRYPT_MODE, key);
byte[] encryptedBytes = cipher.doFinal(sensitiveInfo.getBytes());

The above code uses the AES algorithm to encrypt the sensitive information using a generated key.

How to Ask AI to Check Your Code for Cleartext Storage of Sensitive Information

To ask an AI coding assistant to review your code for Cleartext Storage of Sensitive Information (CWE-312), use the following prompt:

Review the following [language] code block for potential CWE-312 Cleartext Storage of Sensitive Information vulnerabilities and rewrite it using encryption-at-rest mechanisms: [paste code here]

```div class=”callout callout–violet”>

Review the following [language] code block for potential CWE-312 Cleartext Storage of Sensitive Information vulnerabilities and rewrite it using encryption-at-rest mechanisms: [paste code here]

</div>

Cleartext Storage of Sensitive Information Best Practices Checklist

✅ Use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls to protect sensitive information. ✅ Regularly review and update access controls to ensure only authorized personnel can access sensitive data.

Cleartext Storage of Sensitive Information FAQ

How does Cleartext Storage of Sensitive Information occur?

Cleartext Storage of Sensitive Information occurs when sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.

What are the consequences of Cleartext Storage of Sensitive Information?

The consequences of Cleartext Storage of Sensitive Information include unauthorized access to sensitive data, which can lead to financial loss, reputational damage, and compliance issues.

How do I prevent Cleartext Storage of Sensitive Information?

To prevent Cleartext Storage of Sensitive Information, use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls.

Can AI help me detect Cleartext Storage of Sensitive Information in my code?

Yes, PenScan’s automated scan engines can help you detect Cleartext Storage of Sensitive Information in your code by analyzing it for potential vulnerabilities and providing recommendations for remediation.

What are some best practices to follow when storing sensitive information?

When storing sensitive information, use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls. Regularly review and update access controls to ensure only authorized personnel can access sensitive data.

How do I fix Cleartext Storage of Sensitive Information in my code?

To fix Cleartext Storage of Sensitive Information, use encryption-at-rest mechanisms such as database column encryption or cloud storage provider controls. Regularly review and update access controls to ensure only authorized personnel can access sensitive data.

Can I prevent Cleartext Storage of Sensitive Information by using a specific programming language?

No, preventing Cleartext Storage of Sensitive Information requires proper configuration and usage of encryption-at-rest mechanisms, regardless of the programming language used.

Vulnerabilities Related to Cleartext Storage of Sensitive Information

References

• MITRE CWE-312
• OWASP A06:2025 - Insecure Design
• CAPEC-37
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Cleartext Storage of Sensitive Information and other risks before an attacker does. ```

This is the complete Jekyll blog post for CWE-312: Cleartext Storage of Sensitive Information.