CWE-523 Unprotected Transport of Credentials
What this means
SiteShadow flagged credentials being transmitted without adequate protection (no TLS, weak transport settings, or credentials placed in easily leaked locations like URLs).
Why it matters
Credentials can be intercepted over weak channels.
- Credential theft via network interception (Wi‑Fi, proxies, compromised routers).
- Replay attacks: stolen tokens/passwords are reused to access accounts/services.
- Long-tail leakage: credentials in URLs leak to logs, referrers, analytics, and support tools.
Safer examples
1) Use HTTPS/TLS everywhere and enforce it
Redirect HTTP→HTTPS, enable HSTS, and keep TLS verification enabled (see T01 / CWE-295).
2) Never send credentials in query strings
Use headers (Authorization) or POST bodies, and avoid embedding creds in URLs (see CRED-URL).
3) Use short-lived, scoped credentials
Prefer short-lived access tokens and rotate/expire them (see TOK01).
How SiteShadow detects it (high level)
- Flags credential-like data being sent over insecure transports or placed into URLs.
- Detects known "insecure transport" settings and missing TLS enforcement around auth flows.
References
- CWE-523: https://cwe.mitre.org/data/definitions/523.html
---