CWE-523 Unprotected Transport of Credentials

Coverage: 2 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 2 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged credentials being transmitted without adequate protection (no TLS, weak transport settings, or credentials placed in easily leaked locations like URLs).

Why it matters

Credentials can be intercepted over weak channels.

• Credential theft via network interception (Wi‑Fi, proxies, compromised routers).
• Replay attacks: stolen tokens/passwords are reused to access accounts/services.
• Long-tail leakage: credentials in URLs leak to logs, referrers, analytics, and support tools.

Safer examples

1) Use HTTPS/TLS everywhere and enforce it

Redirect HTTP→HTTPS, enable HSTS, and keep TLS verification enabled (see T01 / CWE-295).

2) Never send credentials in query strings

Use headers (Authorization) or POST bodies, and avoid embedding creds in URLs (see CRED-URL).

3) Use short-lived, scoped credentials

Prefer short-lived access tokens and rotate/expire them (see TOK01).

How SiteShadow detects it (high level)

• Flags credential-like data being sent over insecure transports or placed into URLs.
• Detects known "insecure transport" settings and missing TLS enforcement around auth flows.

References

• CWE-523: https://cwe.mitre.org/data/definitions/523.html

---

← Back to Vulnerability Library