What is Unprotected Transport of Credentials (CWE-523)?

TL;DR: Unprotected Transport of Credentials (CWE-523) is a critical vulnerability where user credentials are transmitted in cleartext over an unencrypted connection, allowing attackers to intercept and steal login information. To fix it, enforce SSL/TLS usage for all sensitive pages.

What is Unprotected Transport of Credentials?

Unprotected Transport of Credentials (CWE-523) is a type of vulnerability where user credentials are transmitted in cleartext over an unencrypted connection. As defined by the MITRE Corporation under CWE-523, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures…

Quick Summary

Unprotected Transport of Credentials is a critical security flaw where user credentials are transmitted in cleartext over an unencrypted connection. This allows attackers to intercept login information, leading to unauthorized access and other severe consequences.

Jump to: Quick Summary · Unprotected Transport of Credentials Overview · How Unprotected Transport of Credentials Works · Business Impact of Unprotected Transport of Credentials · Unprotected Transport of Credentials Attack Scenario · How to Detect Unprotected Transport of Credentials · How to Fix Unprotected Transport of Credentials · Framework-Specific Fixes for Unprotected Transport of Credentials · How to Ask AI to Check Your Code for Unprotected Transport of Credentials · Unprotected Transport of Credentials Best Practices Checklist · Unprotected Transport of Credentials FAQ · Vulnerabilities Related to Unprotected Transport of Credentials · References · Scan Your Own Site

Unprotected Transport of Credentials Overview

What: Unprotected Transport of Credentials is a vulnerability where user credentials are transmitted in cleartext over an unencrypted connection.

Why it matters: This allows attackers to intercept and steal login information, leading to unauthorized access and other security breaches.

Where it occurs: On web applications that do not enforce SSL/TLS for sensitive pages or forms.

Who is affected: Any user whose credentials are transmitted in cleartext over an unencrypted connection.

Who is NOT affected: Applications that use HTTPS exclusively for all sensitive data transmission.

How Unprotected Transport of Credentials Works

Root Cause

The root cause lies in the lack of SSL/TLS encryption when transmitting user credentials, allowing attackers to intercept and steal login information.

Attack Flow

1. Attacker identifies an unencrypted connection used by a web application.
2. Attacker uses tools like Wireshark or Burp Suite to capture HTTP traffic containing sensitive data.
3. Credentials are intercepted and stored for later use.

Prerequisites to Exploit

• The attacker must be able to intercept network traffic between the client and server.
• The web application must not enforce SSL/TLS usage for login pages or other sensitive endpoints.

Vulnerable Code

def login(request):
    username = request.POST['username']
    password = request.POST['password']
    # Transmit credentials over HTTP

This code demonstrates an unencrypted transmission of user credentials, making them vulnerable to interception.

Secure Code

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def login(request):
    username = request.POST.get('username')
    password = request.POST.get('password')
    # Ensure HTTPS is enforced and transmit credentials securely

This secure code enforces SSL/TLS usage for sensitive pages, ensuring that credentials are transmitted over a secure connection.

Business Impact of Unprotected Transport of Credentials

Confidentiality: Exposes user login information to interception by attackers. Integrity: Allows unauthorized access leading to potential data modification or theft. Availability: Can disrupt services if attackers exploit stolen credentials for denial-of-service attacks.

• Financial losses due to unauthorized access and data breaches.
• Compliance fines for violating security standards.
• Reputational damage from customer trust erosion.

Unprotected Transport of Credentials Attack Scenario

1. Attacker identifies an unencrypted login page on a web application.
2. Using tools like Wireshark, the attacker captures HTTP traffic containing user credentials.
3. The intercepted credentials are used to gain unauthorized access to the system.

How to Detect Unprotected Transport of Credentials

Manual Testing

• Inspect URLs in forms and pages that handle sensitive data for HTTP instead of HTTPS.
• Check if the site redirects from HTTP to HTTPS automatically.
• Verify configuration settings enforce SSL/TLS usage for all sensitive endpoints.

Automated Scanners (SAST / DAST)

Static analysis can detect unencrypted connections, but dynamic testing is necessary to confirm actual interception vulnerabilities in a live environment.

PenScan Detection

PenScan’s scanner engines like ZAP and Wapiti actively test for this issue by attempting to capture credentials over HTTP.

False Positive Guidance

A false positive may occur if the application uses secure protocols internally but exposes an unencrypted endpoint. Ensure that all sensitive data transmission occurs over HTTPS.

How to Fix Unprotected Transport of Credentials

• Enforce SSL/TLS usage for login pages and other sensitive endpoints.
• Redirect HTTP traffic to HTTPS automatically using server configuration settings.

Framework-Specific Fixes for Unprotected Transport of Credentials

Python/Django

SECURE_SSL_REDIRECT = True

This setting ensures all requests are redirected to HTTPS, protecting user credentials from interception.

How to Ask AI to Check Your Code for Unprotected Transport of Credentials

Unprotected Transport of Credentials Best Practices Checklist

✅ Enforce SSL/TLS usage for all sensitive pages. ✅ Redirect HTTP traffic to HTTPS automatically. ✅ Verify configuration settings enforce secure connections.

Unprotected Transport of Credentials FAQ

How does unprotected transport of credentials work?

Unprotected transport of credentials occurs when user names and passwords are transmitted in cleartext over an unencrypted connection, making them vulnerable to interception by attackers. This can happen if the login page or any page used to transmit sensitive information is not served over HTTPS.

What are the potential consequences of unprotected transport of credentials?

Attackers can intercept and steal user credentials, leading to unauthorized access, identity theft, and other security breaches. This vulnerability undermines confidentiality and integrity by exposing sensitive data in transit.

How do I detect unprotected transport of credentials manually?

Manually inspect the login page or any form that transmits sensitive information for HTTP requests instead of HTTPS. Check if the site redirects from HTTP to HTTPS automatically, ensuring all sensitive pages use SSL/TLS encryption.

What are some common signs of unprotected transport of credentials in code?

Look for URLs using HTTP (not HTTPS) when handling login or other sensitive data submission forms. Also check for lack of configuration settings that enforce the use of secure connections.

How can I prevent unprotected transport of credentials with SSL/TLS?

Enforce SSL/TLS usage by configuring your web server to redirect all HTTP traffic to HTTPS, and ensure that any pages or endpoints handling sensitive data are served over a secure connection.

What is the impact on business operations if this vulnerability exists?

financial losses due to unauthorized access, compliance fines for violating security standards, and reputational damage from customer trust erosion.

Can you provide an example of how to fix unprotected transport of credentials in Python/Django?

In Django settings.py, set SECURE_SSL_REDIRECT = True to enforce HTTPS redirection. Additionally, ensure all views that handle sensitive data are decorated with @login_required and use secure cookies.

Vulnerabilities Related to Unprotected Transport of Credentials

| CWE | Name | Relationship | |—|—|—| | CWE-522 | Insufficiently Protected Credentials (ChildOf) | | | CWE-319 | Cleartext Transmission of Sensitive Information (CanAlsoBe) |

References

• MITRE - Unprotected Transport of Credentials
• OWASP Top 10:2025 - Cryptographic Failures
• CAPEC - Intercepting Sensitive Information
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Unprotected Transport of Credentials and other risks before an attacker does.