[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CWE
view XML

Improper Authentication

ID: 287Date: (C)2012-05-14   (M)2017-10-19
Type: weaknessStatus: DRAFT
Abstraction Type: Class





Description

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Likelihood of Exploit: Medium to High

Applicable Platforms
Language Class: Language-independent

Time Of Introduction

  • Architecture and Design
  • Implementation

Related Attack Patterns

Common Consequences

ScopeTechnical ImpactNotes
Integrity
Confidentiality
Availability
Access_Control
 
Read application data
Gain privileges / assume identity
Execute unauthorized code or commands
 
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
 

Detection Methods

NameDescriptionEffectivenessNotes
Automated Static Analysis
 
Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries.
Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.
 
Limited
 
 
Manual Static Analysis
 
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.
 
High
 
 

Potential Mitigations

PhaseStrategyDescriptionEffectivenessNotes
Architecture and Design
 
Libraries or Frameworks
 
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
 
  

Relationships
This can be resultant from SQL injection vulnerabilities and other issues.

Related CWETypeViewChain
CWE-287 ChildOf CWE-898 Category CWE-888  

Demonstrative Examples   (Details)

  1. In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.
  2. The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.

Observed Examples

  1. CVE-2009-3421 : login script for guestbook allows bypassing authentication by setting a "login_ok" parameter to 1.
  2. CVE-2009-2382 : admin script allows authentication bypass by setting a cookie value to "LOGGEDIN".
  3. CVE-2009-1048 : VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
  4. CVE-2009-2213 : product uses default "Allow" action, instead of default deny, leading to authentication bypass.
  5. CVE-2009-2168 : chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
  6. CVE-2009-3107 : product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
  7. CVE-2009-1596 : product does not properly implement a security-related configuration setting, allowing authentication bypass.
  8. CVE-2009-2422 : authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username.
  9. CVE-2009-3232 : authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
  10. CVE-2009-3231 : use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
  11. CVE-2005-3435 : product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
  12. CVE-2005-0408 : chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.

For more examples, refer to CVE relations in the bottom box.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

TaxynomyIdNameFit
PLOVER  Authentication Error
 
 
OWASP Top Ten 2007 A7
 
Broken Authentication and Session Management
 
CWE_More_Specific
 
OWASP Top Ten 2004 A3
 
Broken Authentication and Session Management
 
CWE_More_Specific
 
WASC 1
 
Insufficient Authentication
 
 

References:

  1. OWASP .Top 10 2007-Broken Authentication and Session Management.
  2. OWASP .Guide to Authentication.
  3. Microsoft .Authentication.
  4. M. Howard D. LeBlanc .Writing Secure Code 2nd Edition. Microsoft. Section:'Chapter 4, "Authentication" Page 109'. Published on 2002.
CVE    665
CVE-2002-2417
CVE-2002-2397
CVE-2003-0216
CVE-2002-2427
...

© 2013 SecPod Technologies