Security Database IT Watching

Improper Authentication

Weakness ID: 287 (Weakness Class)

Status: Draft

Description

Description Summary

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Alternate Terms

authentification:	An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries.
AuthC:	"AuthC" is typically used as an abbreviation of "authentication" within the web application security community. It is also distinct from "AuthZ," which is an abbreviation of "authorization." The use of "Auth" as an abbreviation is discouraged, since it could be used for either authentication or authorization.

Time of Introduction

Architecture and Design
Implementation

Applicable Platforms

Languages

Language-independent

Common Consequences

Scope	Effect
Integrity Access Control	This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Likelihood of Exploit

Medium to High

Detection Methods

Automated Static Analysis

Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries.

Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.

Effectiveness: Limited

Manual Static Analysis

This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.

Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.

Effectiveness: High

These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

Demonstrative Examples

Example 1

The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.

(Bad Code)

my $q = new CGI;

if ($q->cookie('loggedin') ne "true") {

if (! AuthenticateUser($q->param('username'), $q->param('password'))) {

ExitError("Error: you need to log in first");

}

else {

# Set loggedin and user cookies.

$q->cookie(

-name => 'loggedin',

-value => 'true'

);

$q->cookie(

-name => 'user',

-value => $q->param('username')

);

}

if ($q->cookie('user') eq "Administrator") {

DoAdministratorTasks();

}

Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:

(Attack)

GET /cgi-bin/vulnerable.cgi HTTP/1.1

Cookie: user=Administrator

Cookie: loggedin=true

[body of request]

By setting the loggedin cookie to "true", the attacker bypasses the entire authentication check. By using the "Administrator" value in the user cookie, the attacker also gains privileges to administer the software.

Example 2

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

Example 2 References:

Kim Zetter. "Weak Password Brings ‘Happiness’ to Twitter Hacker". 2009-01-09. <http://www.wired.com/threatlevel/2009/01/professed-twitt/>.

Observed Examples

Reference	Description
CVE-2009-3421	login script for guestbook allows bypassing authentication by setting a "login ok" parameter to 1.
CVE-2009-2382	admin script allows authentication bypass by setting a cookie value to "LOGGEDIN".
CVE-2009-1048	VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
CVE-2009-2213	product uses default "Allow" action, instead of default deny, leading to authentication bypass.
CVE-2009-2168	chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
CVE-2009-3107	product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
CVE-2009-1596	product does not properly implement a security-related configuration setting, allowing authentication bypass.
CVE-2009-2422	authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username.
CVE-2009-3232	authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
CVE-2009-3231	use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
CVE-2005-3435	product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
CVE-2005-0408	chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.

Potential Mitigations

Phase: Architecture and Design

Strategy: Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Category	254	Security Features	Development Concepts (primary)699
ChildOf	Weakness Class	693	Protection Mechanism Failure	Research Concepts (primary)1000
ChildOf	Category	718	OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management	Weaknesses in OWASP Top Ten (2007) (primary)629
ChildOf	Category	724	OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management	Weaknesses in OWASP Top Ten (2004) (primary)711
ParentOf	Weakness Class	300	Channel Accessible by Non-Endpoint ('Man-in-the-Middle')	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Variant	301	Reflection Attack in an Authentication Protocol	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	303	Incorrect Implementation of Authentication Algorithm	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	304	Missing Critical Step in Authentication	Development Concepts (primary)699
ParentOf	Weakness Variant	306	Missing Authentication for Critical Function	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	307	Improper Restriction of Excessive Authentication Attempts	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	308	Use of Single-factor Authentication	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	309	Use of Password System for Primary Authentication	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	322	Key Exchange without Entity Authentication	Research Concepts (primary)1000
ParentOf	Compound Element: Composite	384	Session Fixation	Development Concepts699 Research Concepts (primary)1000
ParentOf	Weakness Class	592	Authentication Bypass Issues	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	603	Use of Client-Side Authentication	Development Concepts (primary)699 Research Concepts1000
ParentOf	Weakness Base	645	Overly Restrictive Account Lockout Mechanism	Development Concepts (primary)699 Research Concepts (primary)1000
ParentOf	Weakness Base	798	Use of Hard-coded Credentials	Research Concepts (primary)1000
ParentOf	Weakness Base	804	Guessable CAPTCHA	Development Concepts699 Research Concepts1000
MemberOf	View	635	Weaknesses Used by NVD	Weaknesses Used by NVD (primary)635
CanFollow	Weakness Base	304	Missing Critical Step in Authentication	Research Concepts1000
CanFollow	Weakness Base	613	Insufficient Session Expiration	Development Concepts699 Research Concepts1000

Relationship Notes

This can be resultant from SQL injection vulnerabilities and other issues.

Functional Areas

Authentication

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER			Authentication Error
OWASP Top Ten 2007	A7	CWE More Specific	Broken Authentication and Session Management
OWASP Top Ten 2004	A3	CWE More Specific	Broken Authentication and Session Management
WASC	1		Insufficient Authentication

Related Attack Patterns

CAPEC-ID	Attack Pattern Name	(CAPEC Version: 1.4)
22	Exploiting Trust in Client (aka Make the Client Invisible)
94	Man in the Middle Attack
57	Utilizing REST's Trust in the System Resource to Register Man in the Middle
114	Authentication Abuse

References

OWASP. "Top 10 2007-Broken Authentication and Session Management". <http://www.owasp.org/index.php/Top_10_2007-A7>.

OWASP. "Guide to Authentication". <http://www.owasp.org/index.php/Guide_to_Authentication>.

Microsoft. "Authentication". <http://msdn.microsoft.com/en-us/library/aa374735(VS.85).aspx>.

[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 4, "Authentication" Page 109. 2nd Edition. Microsoft. 2002.

Content History

Submissions
Submission Date	Submitter	Organization	Source
	PLOVER		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time of Introduction
2008-08-15		Veracode	External
2008-08-15	Suggested OWASP Top Ten 2004 mapping
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Alternate Terms, Common Consequences, Relationships, Relationship Notes, Taxonomy Mappings
2008-10-14	CWE Content Team	MITRE	Internal
2008-10-14	updated Relationships
2009-01-12	CWE Content Team	MITRE	Internal
2009-01-12	updated Name
2009-05-27	CWE Content Team	MITRE	Internal
2009-05-27	updated Description, Related Attack Patterns
2009-07-27	CWE Content Team	MITRE	Internal
2009-07-27	updated Relationships
2009-10-29	CWE Content Team	MITRE	Internal
2009-10-29	updated Common Consequences, Observed Examples
2009-12-28	CWE Content Team	MITRE	Internal
2009-12-28	updated Applicable Platforms, Common Consequences, Demonstrative Examples, Detection Factors, Likelihood of Exploit, References
Previous Entry Names
Change Date	Previous Entry Name
2008-04-11	Authentication Issues

2009-01-12	Insufficient Authentication