Rule Definition
Service providers using Username Token may accept passwords sent in clear text. If the plaintext password is sent through an unencrypted channel, an attacker who can intercept the SOAP message will take the opportunity to obtain credentials.

Remediation
Always use Windows or Certificate as client credential type

Violation Code Sample

XML Config:

<system.serviceModel>  
  <bindings>  
    <wsHttpBinding>  
      <binding name="SecureBinding">  
        <security mode="Message">  
             <message clientCredentialType="UserName" />  //Violation - Client Credential type 
                                                          //None/UserName/IssuedToken are not preferred
         </security>  
      </binding>  
    </wsHttpBinding>  
  </bindings>  
</system.serviceModel>  

______________________________________________________________________

C#:
ServiceHost myServiceHost = new ServiceHost(typeof(CalculatorService));
// Create a binding to use.
WSHttpBinding binding = new WSHttpBinding();
binding.Security.Mode = SecurityMode.Message;
binding.Security.Message.ClientCredentialType =
    MessageCredentialType.None; //Violation: Client Credential type Issued Token/None/UserName are not preferred

Fixed Code Sample

XML Config:

<system.serviceModel>  
  <bindings>  
    <wsHttpBinding>  
      <binding name="SecureBinding">  
        <security mode="Message">  
             <message clientCredentialType="Windows" />  //Violation Fixed
         </security>  
      </binding>  
    </wsHttpBinding>  
  </bindings>  
</system.serviceModel>  
_______________________________________________________________

C#:
ServiceHost myServiceHost = new ServiceHost(typeof(CalculatorService));
// Create a binding to use.
WSHttpBinding binding = new WSHttpBinding();
binding.Security.Mode = SecurityMode.Message;
binding.Security.Message.ClientCredentialType =
    MessageCredentialType.Certificate; //Fixed-Credential type certificate is used

https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/wcf/clientcredentials OWASP Top 10 2017 A6 Security Misconfiguration