CWE-547 (使用硬编码、安全相关的常数) — Vulnerability Class 10

CWE-547 represents a critical software weakness where security-sensitive values, such as encryption keys or access control thresholds, are hardcoded directly into the source code rather than being stored in configurable external files or environment variables. This practice significantly increases the risk of security breaches because updating these constants requires modifying and recompiling the application, which often leads to inconsistent updates across different instances. Attackers exploit this by reverse-engineering the binary to extract these static secrets, bypassing authentication or decrypting sensitive data without needing to compromise the system’s dynamic logic. To mitigate this risk, developers must adopt secure configuration management practices, storing all security-relevant constants in protected, external repositories. This ensures that sensitive values can be rotated or updated independently of the codebase, maintaining flexibility and reducing the attack surface associated with static, embedded credentials.