Summary #

Invicti detected that the Spring Boot web application is storing MongoDB credentials in plain text in the properties files via spring.data.mongodb.password. It's not recommended to store plain text passwords in configuration files.

Impact #

An attacker that is able to read the properties files has access to all the credentials stored in this file and could use this information to conduct further attacks.

Actions To Take #

It's recommended to encrypt the credentials using a library like Jasypt. By using Jasypt, you can provide encryption for the property sources and the application can decrypt the encrypted properties and retrieve the original values.

Classifications #
CWE-16; OWASP 2013-A5; OWASP 2017-A6 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo