Page History

Hard coding sensitive information, such as passwords, server IP addresses, and encryption keys can expose the information to attackers. Anyone who has access to the class files can decompile them and discover the sensitive information. Leaking data protected by International Traffic in Arms Regulations (ITAR) or the Health Insurance Portability and Accountability Act (HIPAA) can also have legal consequences. Consequently, programs must not hard code sensitive information.

...

This noncompliant code example includes a hard-coded server IP address in a constant String.:

class IPaddress {
  String ipAddress = new String("172.16.254.1");
  public static void main(String[] args) {
    //...
  }
}

A malicious user can use the javap -c IPaddress command to disassemble the class and discover the hard-coded server IP address. The output of the disassembler reveals the server IP address 172.16.254.1 in clear text:

...

class IPaddress {
  public static void main(String[] args) throws IOException {
    char[] ipAddress = new char[100];
    BufferedReader br = new BufferedReader(new InputStreamReader(
        new FileInputStream("serveripaddress.txt")));

    // Reads the server IP address into the char array,
    // returns the number of bytes read 
    int n = br.read(ipAddress);  
    // Validate server IP address
    // Manually clear out the server IP address
    // immediately after use 
    for (int i = n - 1; i >= 0; i--) {  
      ipAddress[i] = 0;
    }
    br.close();
  }
}

...

The user name and password fields in the SQL connection request are hard coded in this noncompliant code example.:

public final Connection getConnection() throws SQLException {
  return DriverManager.getConnection(
      "jdbc:mysql://localhost/dbName", 
      "username", "password");
}

Note that the one- and two-two argument java.sql.DriverManager.getConnection() methods can also be used incorrectly.

...

This compliant solution reads the user name and password from a configuration file located in a secure directory.:

public final Connection getConnection() throws SQLException {
  String username;
  String password;
  // Username and password are read at runtime from a secure config file
  return DriverManager.getConnection(
      "jdbc:mysql://localhost/dbName", username, password);
}

...

When possible, sensitive information such as passwords should be stored in character arrays rather than strings , because the JVM Java Virtual Machine may retain strings long after they are no longer needed. However, this example uses strings because DriverManager.getConnection() requires them.

...

Hard coding sensitive information exposes that information to attackers. The severity of this rule can vary based depending on the kind of information that is disclosed.   HoweverFrequently, frequently the information disclosed is password or key information, which can lead to remote exploitation.   Consequently, a high severity rating is given , but may be adjusted downwards based on according to the nature of the sensitive data. 

Automated Detection

Related Vulnerabilities

GERONIMO-2925, GERONIMO-1135 describes  describes a vulnerability in the WAS CE tool, which is based on Apache Geronimo. It uses the Advanced Encryption Standard (AES) to encrypt passwords but uses a hard-coded key that is identical for all the WAS CE server instances. Consequently, anyone who can download the software is provided with the key to every instance of the tool. This vulnerability was resolved by having each new installation of the tool generate its own unique key and use it from that time on.

...

Android Implementation Details

Hard-coded information can be easily obtained on Android by using the apktool to decompile an application or by using dex2jar to convert a dex file to a jar file.

Bibliography

...