CWE-319: Cleartext Transmission of Sensitive Information

Description:
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Cloud Computing, Mobile, ICS/OT, System on Chip, Test/Debug Hardware
Parent weaknesses: CWE-311, CWE-311

Consequences:
  - Integrity: Read Application Data
  - Integrity: Read Application Data

Detection methods:
  - Black Box: Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software w
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
  - [Implementation] When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.
  - [Implementation] When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.
  - [Testing] Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses

Demonstrative examples:
The following code attempts to establish a connection to a site to communicate sensitive information.
Though a connection is successfully made, the connection is unencrypted and it is possible that all sensitive data sent to or received from the server will be read by unintended actors.
try { URL u = new URL("http://www.secret.example.org/"); HttpURLConnection hu = (HttpURLConnection) u.openConnection(); hu.setRequestMethod("PUT"); hu.connect(); OutputStream os = hu.getOutputStream(); hu.disconnect(); } catch (IOException e) { 
                            //... 
                            
                      }

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple vendors used cleartext transmission of sensitive information in their OT products.

Real-world examples:
  - CVE-2022-29519: Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens.
  - CVE-2022-30312: Building Controller uses a protocol that transmits authentication credentials in plaintext.
  - CVE-2022-31204: Programmable Logic Controller (PLC) sends password in plaintext.
  - CVE-2002-1949: Passwords transmitted in cleartext.
  - CVE-2008-4122: Chain: Use of HTTPS cookie without "secure" flag causes it to be transmitted across unencrypted HTTP.