What is Insufficiently Protected Credentials (CWE-522)?

TL;DR: Insufficiently Protected Credentials (CWE-522) is a vulnerability where authentication credentials are transmitted or stored insecurely, allowing attackers to intercept and retrieve them. To prevent this, use secure methods such as encryption.

What is Insufficiently Protected Credentials?

Insufficiently Protected Credentials (CWE-522) is a type of vulnerability where authentication credentials are transmitted or stored using insecure methods. As defined by the MITRE Corporation under CWE-522, and classified by the OWASP Foundation under A06:2025 - Insecure Design.

Quick Summary

Insufficiently Protected Credentials (CWE-522) is a serious security issue where authentication credentials are transmitted or stored insecurely. This allows attackers to intercept and retrieve these credentials, leading to unauthorized access and data breaches. Jump to:

Jump to: Quick Summary · Insufficiently Protected Credentials Overview · How Insufficiently Protected Credentials Works · Business Impact of Insufficiently Protected Credentials · Insufficiently Protected Credentials Attack Scenario · How to Detect Insufficiently Protected Credentials · How to Fix Insufficiently Protected Credentials · Framework-Specific Fixes for Insufficiently Protected Credentials · How to Ask AI to Check Your Code for Insufficiently Protected Credentials · Insufficiently Protected Credentials Best Practices Checklist · Insufficiently Protected Credentials FAQ · Vulnerabilities Related to Insufficiently Protected Credentials · References · Scan Your Own Site

Insufficiently Protected Credentials Overview

What: Insufficiently Protected Credentials is a vulnerability where authentication credentials are transmitted or stored insecurely.

Why it matters: Attackers can intercept and retrieve these credentials, leading to unauthorized access and data breaches.

Where it occurs: In web applications, databases, and configuration files that handle sensitive data.

Who is affected: Any application that transmits or stores authentication credentials without proper protection.

Who is NOT affected: Applications that do not transmit or store authentication credentials insecurely.

How Insufficiently Protected Credentials Works

Root Cause

The root cause of this vulnerability lies in the use of insecure methods to transmit or store authentication credentials, making them susceptible to interception and retrieval by attackers.

Attack Flow

1. The attacker intercepts the transmission or retrieves stored credentials.
2. The attacker uses the intercepted credentials to gain unauthorized access to user accounts.
3. The attacker accesses sensitive data used by the compromised user accounts.

Prerequisites to Exploit

• Insecure method for transmitting or storing authentication credentials.
• Lack of proper encryption and protection mechanisms.

Vulnerable Code

def store_credentials(username, password):
    with open('credentials.txt', 'w') as file:
        file.write(f'{username}:{password}')

This code stores the username and password in a plain text file without any form of encryption or secure storage mechanism. This makes it vulnerable to interception.

Secure Code

from cryptography.fernet import Fernet

def store_credentials(username, password):
    key = b'your-encryption-key'
    fernet = Fernet(key)
    
    encrypted_password = fernet.encrypt(password.encode())
    with open('credentials.txt', 'w') as file:
        file.write(f'{username}:{encrypted_password.decode()}')

This code uses the cryptography library to encrypt the password before storing it in a file, ensuring that even if the file is compromised, the credentials remain secure.

Business Impact of Insufficiently Protected Credentials

Confidentiality

Attackers can access sensitive data used by user accounts due to insecure storage or transmission methods.

Integrity

Unauthorized users may modify data accessed through stolen credentials, compromising integrity.

Availability

In severe cases, attackers might disrupt availability by exploiting compromised credentials for denial-of-service attacks.

Insufficiently Protected Credentials Attack Scenario

1. An attacker intercepts the transmission of authentication credentials.
2. The attacker uses these intercepted credentials to gain unauthorized access to user accounts.
3. The attacker exploits this access to steal sensitive data and cause further damage.

How to Detect Insufficiently Protected Credentials

Manual Testing

• Review configuration files for insecure storage methods.
• Check code for plain text transmission of authentication credentials.
• Verify that encryption mechanisms are properly implemented.

Automated Scanners (SAST / DAST)

Static analysis can identify insecure storage practices, while dynamic testing can detect vulnerabilities during runtime.

PenScan Detection

PenScan’s scanner engines like ZAP and Wapiti can automatically detect Insufficiently Protected Credentials in your application.

False Positive Guidance

A finding is likely real if the credentials are stored or transmitted without proper encryption. A false positive may occur when a secure mechanism is mistakenly flagged due to context not visible to the scanner.

How to Fix Insufficiently Protected Credentials

• Use an appropriate security mechanism to protect the credentials.
• Make appropriate use of cryptography to protect the credentials.
• Use industry standards to protect the credentials (e.g., LDAP, keystore).

Framework-Specific Fixes for Insufficiently Protected Credentials

Python/Django

from cryptography.fernet import Fernet

def store_credentials(username, password):
    key = b'your-encryption-key'
    fernet = Fernet(key)
    
    encrypted_password = fernet.encrypt(password.encode())
    with open('credentials.txt', 'w') as file:
        file.write(f'{username}:{encrypted_password.decode()}')

Java

import javax.crypto.Cipher;
import java.security.Key;

public class SecureCredentials {
    public static void storeCredentials(String username, String password) throws Exception {
        Key key = generateKey();
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        
        byte[] encryptedPassword = cipher.doFinal(password.getBytes());
        // Store the encrypted password securely
    }
}

Node.js

const crypto = require('crypto');

function storeCredentials(username, password) {
    const key = 'your-encryption-key';
    const iv = crypto.randomBytes(16);
    
    const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(key), iv);
    let encryptedPassword = cipher.update(password, 'utf8', 'hex');
    encryptedPassword += cipher.final('hex');

    // Store the encrypted password securely
}

PHP

function storeCredentials($username, $password) {
    $key = 'your-encryption-key';
    
    $iv_size = openssl_cipher_iv_length('AES-256-CBC');
    $iv = openssl_random_pseudo_bytes($iv_size);
    
    $encryptedPassword = openssl_encrypt($password, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);

    // Store the encrypted password securely
}

How to Ask AI to Check Your Code for Insufficiently Protected Credentials

Review the following Python code block for potential CWE-522 Insufficiently Protected Credentials vulnerabilities and rewrite it using appropriate security mechanisms:

Insufficiently Protected Credentials Best Practices Checklist

✅ Use an appropriate security mechanism to protect authentication credentials. ✅ Make appropriate use of cryptography to protect the credentials. ✅ Use industry standards to protect the credentials (e.g., LDAP, keystore). ✅ Ensure that all sensitive data and credentials are encrypted both at rest and during transmission.

Insufficiently Protected Credentials FAQ

How does Insufficiently Protected Credentials work?

Insufficiently Protected Credentials allows attackers to intercept or retrieve authentication credentials, compromising user accounts.

What are the common consequences of Insufficiently Protected Credentials?

Attackers can gain unauthorized access and control sensitive data used by user accounts.

How do I detect Insufficiently Protected Credentials in my code?

Use manual testing techniques like reviewing configuration files and automated scanners to identify insecure credential storage or transmission methods.

What is the primary fix for Insufficiently Protected Credentials?

Implement appropriate security mechanisms, such as encryption, to protect authentication credentials.

How can I prevent Insufficiently Protected Credentials in web applications?

Ensure that all sensitive data and credentials are encrypted both at rest and during transmission.

What is the difference between CWE-522 and other related weaknesses like CWE-1390 or CWE-668?

Insufficiently Protected Credentials (CWE-522) specifically addresses insecure methods of storing or transmitting credentials, while others may focus on broader authentication issues.

How can I use PenScan to detect Insufficiently Protected Credentials?

Use PenScan’s automated scanners like ZAP and Wapiti to identify insecure credential handling practices in your application.

Vulnerabilities Related to Insufficiently Protected Credentials

References

• MITRE
• OWASP A06:2025 - Insecure Design
• CAPEC-102, CAPEC-474, etc.
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Insufficiently Protected Credentials and other risks before an attacker does.