Improper AuthenticationID: 287 | Date: (C)2012-05-14 (M)2022-10-10 |
Type: weakness | Status: DRAFT |
Abstraction Type: Class |
Description
When an actor claims to have a given identity, the software
does not prove or insufficiently proves that the claim is
correct.
Likelihood of Exploit: Medium to High
Applicable PlatformsLanguage Class: Language-independent
Time Of Introduction
- Architecture and Design
- Implementation
Related Attack Patterns
Common Consequences
Scope | Technical Impact | Notes |
---|
IntegrityConfidentialityAvailabilityAccess_Control | Read application
dataGain privileges / assume
identityExecute unauthorized code or
commands | This weakness can lead to the exposure of resources or functionality
to unintended actors, possibly providing attackers with sensitive
information or even execute arbitrary code. |
Detection Methods
Name | Description | Effectiveness | Notes |
---|
Automated Static Analysis | Automated static analysis is useful for detecting certain types of
authentication. A tool may be able to analyze related configuration
files, such as .htaccess in Apache web servers, or detect the usage of
commonly-used authentication libraries.Generally, automated static analysis tools have difficulty detecting
custom authentication schemes. In addition, the software's design may
include some functionality that is accessible to any user and does not
require an established identity; an automated technique that detects the
absence of authentication may report false positives. | Limited | |
Manual Static Analysis | This weakness can be detected using tools and techniques that require
manual (human) analysis, such as penetration testing, threat modeling,
and interactive tools that allow the tester to record and modify an
active session.Manual static analysis is useful for evaluating the correctness of
custom authentication mechanisms. | High | |
Potential Mitigations
Phase | Strategy | Description | Effectiveness | Notes |
---|
Architecture and Design | Libraries or Frameworks | Use an authentication framework or library such as the OWASP ESAPI
Authentication feature. | | |
RelationshipsThis can be resultant from SQL injection vulnerabilities and other
issues.
Related CWE | Type | View | Chain |
---|
CWE-287 ChildOf CWE-898 | Category | CWE-888 | |
Demonstrative Examples (Details)
- In January 2009, an attacker was able to gain administrator access
to a Twitter server because the server did not restrict the number of login
attempts. The attacker targeted a member of Twitter's support team and was
able to successfully guess the member's password using a brute force with a
large number of common words. Once the attacker gained access as the member
of the support staff, he used the administrator panel to gain access to 33
accounts that belonged to celebrities and politicians. Ultimately, fake
Twitter messages were sent that appeared to come from the compromised
accounts.
- The following code intends to ensure that the user is already logged
in. If not, the code performs authentication with the user-provided username
and password. If successful, it sets the loggedin and user cookies to
"remember" that the user has already logged in. Finally, the code performs
administrator tasks if the logged-in user has the "Administrator" username,
as recorded in the user cookie.
Observed Examples
- CVE-2009-3421 : login script for guestbook allows bypassing authentication by setting a "login_ok" parameter to 1.
- CVE-2009-2382 : admin script allows authentication bypass by setting a cookie value to "LOGGEDIN".
- CVE-2009-1048 : VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
- CVE-2009-2213 : product uses default "Allow" action, instead of default deny, leading to authentication bypass.
- CVE-2009-2168 : chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
- CVE-2009-3107 : product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
- CVE-2009-1596 : product does not properly implement a security-related configuration setting, allowing authentication bypass.
- CVE-2009-2422 : authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username.
- CVE-2009-3232 : authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
- CVE-2009-3231 : use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
- CVE-2005-3435 : product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
- CVE-2005-0408 : chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.
For more examples, refer to CVE relations in the bottom box.
White Box Definitions None
Black Box Definitions None
Taxynomy Mappings
Taxynomy | Id | Name | Fit |
---|
PLOVER | | Authentication Error | |
OWASP Top Ten 2007 | A7 | Broken Authentication and Session
Management | CWE_More_Specific |
OWASP Top Ten 2004 | A3 | Broken Authentication and Session
Management | CWE_More_Specific |
WASC | 1 | Insufficient Authentication | |
References:
- OWASP .Top 10 2007-Broken Authentication and Session
Management.
- OWASP .Guide to Authentication.
- Microsoft .Authentication.
- M. Howard D. LeBlanc .Writing Secure Code 2nd Edition. Microsoft. Section:'Chapter 4, "Authentication" Page 109'. Published on 2002.