CWE-260 (配置文件中存储口令) — Vulnerability Class 23

CWE-260 represents a critical security weakness where sensitive authentication credentials are stored in plaintext within configuration files accessible to unauthorized users. This flaw typically allows attackers to exploit the vulnerability by reading the configuration file to harvest valid passwords, thereby gaining unauthorized access to the associated system or service. In more severe scenarios, adversaries may modify the stored credentials to lock out legitimate administrators or establish persistent backdoor access. To mitigate this risk, developers must avoid hardcoding secrets in plain text. Instead, they should employ robust encryption mechanisms, utilize dedicated secret management solutions, or leverage environment variables that are strictly restricted by operating system permissions. By ensuring that configuration data remains protected from unauthorized read or write operations, organizations can significantly reduce the attack surface and prevent credential compromise.