CWE Rule 256

Plain Text Password Stored in File System occurs when data read from a file is used in functions that expect plain-text passwords. The checker for this issue detects the flow of data from file read functions to the password parameter of functions that take user credentials.

Functions flagged by this checker include the following:

Storing a password in plain-text form in a configuration file is a security risk. Anyone with access to the file can read the passwords and gain access to the password-protected resource.

Instead of reading passwords from a file system, accept passwords on the fly from standard input.

If passwords have to be stored on the file system, store them in encrypted form. After reading an encrypted password from a file, decrypt the password before use in functions that take user credentials. You can use standard encryption and decryption functions from cryptographic libraries, or write your own functions.

You can extend this checker by specifying your own password functions or decryption functions.

Suppose you want to specify the following:

To make the checker aware of these functions:

In this example, the function foo() reads a password from a configuration file and passes it directly to logOnToServer(), which is a sensitive function. Polyspace reports a violation.

/* SRC.c */
#include <stdio.h>
#include <string.h>

void logOnToServer(const char* user, const char* passwd);
void *memset_s(void *dest, int c, size_t len);

extern char *user;

int foo() {
    FILE* fp = fopen("credentials.cfg", "r");
    if (fp == NULL) {
        return -1;
    }

    char plain_passwd[64];
    if (fgets(plain_passwd, sizeof(plain_passwd), fp) == NULL) {
        fclose(fp);
        return -1;
    }

    logOnToServer(user, plain_passwd); // Noncompliant

    memset_s(plain_passwd, 'X', sizeof(plain_passwd));
    fclose(fp);
    return 0;
}

To specify the function logOnToServer() as a sensitive function, use this datalog code in a datalog (.dl) file as input to the option -code-behavior-specifications. Because the password is read from a file and used without encryption, an attacker who gains access to the configuration file can read the password in plain text.

/* passwordFunctions.dl */
.include "models/interfaces/plain_text_password.dl"

PlainTextPassword.Basic.sensitive("logOnToServer", $InParameterDeref(1)).

One possible correction is to store the password in encrypted form on the file system. After reading the encrypted password, use a decryption function to convert it to plain text before passing it to the sensitive function. The decryption step shows that the password is stored in encrypted form, which fixes the violation.

/* SRC.c */
#include <stdio.h>
#include <string.h>

void logOnToServer(const char* user, const char* passwd);
void decrypt(const char* cipher_text, char* plain_text, size_t plain_text_size);
void *memset_s(void *dest, int c, size_t len);

extern char *user;

int compliant_stored_encrypted() {
    FILE* fp = fopen("credentials.cfg", "r");
    if (fp == NULL) {
        return -1;
    }

    char cipher_passwd[64];
    if (fgets(cipher_passwd, sizeof(cipher_passwd), fp) == NULL) {
        fclose(fp);
        return -1;
    }

    char plain_passwd[64];
    decrypt(cipher_passwd, plain_passwd, sizeof(plain_passwd));

    logOnToServer(user, plain_passwd); // Compliant

    memset_s(plain_passwd, 'X', sizeof(plain_passwd));
    fclose(fp);
    return 0;
}

To specify decrypt as the decryption function, use this datalog code in a datalog (.dl) file as input to the option -code-behavior-specifications.

/* passwordFunctions.dl */
.include "models/interfaces/plain_text_password.dl"

PlainTextPassword.Basic.sensitive("logOnToServer", $InParameterDeref(1)).
PlainTextPassword.Basic.sanitizing("decrypt", $OutParameterDeref(1)).

To run this example, specify the analysis option:

-code-behavior-specifications passwordFunctions.dl