The application must not contain embedded authentication data.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70363	APSC-DV-003110	SV-84985r1_rule		High

Description
Authentication data stored in code could potentially be read and used by anonymous users to gain access to a backend database or application servers. This could lead to compromise of application data.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-03-20

Details

Check Text ( C-70817r1_chk )
Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files. Identify any instances of passwords, certificates, or sensitive data included in code. If credentials were found, check the file permissions and ownership of the offending file. If access to the folder hosting the file is not restricted to the related application process and administrative users, this is a finding. The finding details should note specifically where the offending credentials or data were located and what resources they enabled.

Check Text ( C-70817r1_chk )

Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files.

Identify any instances of passwords, certificates, or sensitive data included in code.

If credentials were found, check the file permissions and ownership of the offending file.

If access to the folder hosting the file is not restricted to the related application process and administrative users, this is a finding.

The finding details should note specifically where the offending credentials or data were located and what resources they enabled.

Fix Text (F-76599r1_fix)
Remove embedded authentication data stored in code, configuration files, scripts, HTML file, or any ASCII files.