Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.
CWE-540 Base Incomplete
Inclusion of Sensitive Information in Source Code
This vulnerability occurs when sensitive information like passwords, API keys, or internal logic is exposed within source code that remains accessible on a web server or in a public repository.
Definition
What is CWE-540?
This vulnerability occurs when sensitive information like passwords, API keys, or internal logic is exposed within source code that remains accessible on a web server or in a public repository.
Leaving source code containing sensitive data on a live server creates a major security risk. Attackers can directly access these files to harvest credentials, encryption keys, or understand application logic, bypassing the intended security controls of the compiled or executed application.
For example, if an attacker retrieves a Perl, Python, or PHP script's source, they can analyze it for bugs, hardcoded database logins, or business logic flaws. This information dramatically simplifies launching further attacks, as it provides a blueprint of the application's weaknesses and secret mechanisms.
Real-world impact
Real-world CVEs caused by CWE-540
-
Server for Team Awareness Kit (TAK) application includes sensitive tokens in the JavaScript source code.
-
The LDAP password might be visible in the html code of a rendered page in an IT Asset Management tool.
-
Version numbers and internal hostnames leaked in HTML comments.
How attackers exploit it
Step-by-step attacker path
- 1
The following code uses an include file to store database credentials:
- 2
database.inc
- 3
login.php
- 4
If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.
- 5
The following comment, embedded in a JSP, will be displayed in the resulting HTML output.
Vulnerable code example
Vulnerable PHP
database.inc
<?php
$dbName = 'usersDB';
$dbPassword = 'skjdh#67nkjd3$3$';
?> Secure code example
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-540
- Architecture and Design / System Configuration Recommendations include removing this script from the web server and moving it to a location not accessible from the Internet.
Detection signals
How to detect CWE-540
Run dynamic application security testing against the live endpoint.
Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.
Code review: flag any new code that handles input from this surface without using the validated framework helpers.
Plexicus auto-detects CWE-540 and opens a fix PR in under 60 seconds.
Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.
Frequently asked questions What is CWE-540?
How serious is CWE-540?
What languages or platforms are affected by CWE-540?
How can I prevent CWE-540?
How does Plexicus detect and fix CWE-540?
Where can I learn more about CWE-540?
Frequently asked questions
What is CWE-540?
This vulnerability occurs when sensitive information like passwords, API keys, or internal logic is exposed within source code that remains accessible on a web server or in a public repository.
How serious is CWE-540?
MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.
What languages or platforms are affected by CWE-540?
MITRE has not specified affected platforms for this CWE — it can apply across most application stacks.
How can I prevent CWE-540?
Recommendations include removing this script from the web server and moving it to a location not accessible from the Internet.
How does Plexicus detect and fix CWE-540?
Plexicus's SAST engine matches the data-flow signature for CWE-540 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-540?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/540.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Related weaknesses
Weaknesses related to CWE-540
CWE-538 Parent
Insertion of Sensitive Information into Externally-Accessible File or Directory
This vulnerability occurs when an application unintentionally stores confidential data—like passwords, API keys, or personal user…
CWE-532 Sibling
Insertion of Sensitive Information into Log File
This vulnerability occurs when an application unintentionally writes confidential data, such as passwords or API keys, into its log files.
CWE-651 Sibling
Exposure of WSDL File Containing Sensitive Information
This vulnerability occurs when a Web Service Definition Language (WSDL) file, which acts as a public blueprint for a web service, is…
CWE-531 Child
Inclusion of Sensitive Information in Test Code
This vulnerability occurs when sensitive data, such as credentials, API keys, or internal logic, is embedded within test code or debugging…
CWE-541 Child
Inclusion of Sensitive Information in an Include File
This vulnerability occurs when sensitive data like passwords or system details is placed inside a publicly accessible include file.…
CWE-615 Child
Inclusion of Sensitive Information in Source Code Comments
This vulnerability occurs when developers leave sensitive details within source code comments. These can include internal file paths,…
Ready when you are
Don't Let Security
Weigh You Down.
Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.