Improper Authentication |
Weakness ID: 287 (Weakness Class) | Status: Draft |
Description Summary
authentification: | An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries. |
---|---|
AuthC: | "AuthC" is typically used as an abbreviation of "authentication" within the web application security community. It is also distinct from "AuthZ," which is an abbreviation of "authorization." The use of "Auth" as an abbreviation is discouraged, since it could be used for either authentication or authorization. |
Scope | Effect |
---|---|
Integrity Access Control | This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. |
Automated Static Analysis Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries. Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives. Effectiveness: Limited |
Manual Static Analysis This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms. Effectiveness: High These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. |
Example 1
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:
By setting the loggedin cookie to "true", the attacker bypasses the entire authentication check. By using the "Administrator" value in the user cookie, the attacker also gains privileges to administer the software.
Example 2
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.
Example 2 References:
Kim Zetter. "Weak Password Brings ‘Happiness’ to Twitter Hacker". 2009-01-09. <http://www.wired.com/threatlevel/2009/01/professed-twitt/>. |
Reference | Description |
---|---|
CVE-2009-3421 | login script for guestbook allows bypassing authentication by setting a "login ok" parameter to 1. |
CVE-2009-2382 | admin script allows authentication bypass by setting a cookie value to "LOGGEDIN". |
CVE-2009-1048 | VOIP product allows authentication bypass using 127.0.0.1 in the Host header. |
CVE-2009-2213 | product uses default "Allow" action, instead of default deny, leading to authentication bypass. |
CVE-2009-2168 | chain: redirect without exit (CWE-698) leads to resultant authentication bypass. |
CVE-2009-3107 | product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed. |
CVE-2009-1596 | product does not properly implement a security-related configuration setting, allowing authentication bypass. |
CVE-2009-2422 | authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username. |
CVE-2009-3232 | authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass. |
CVE-2009-3231 | use of LDAP authentication with anonymous binds causes empty password to result in successful authentication |
CVE-2005-3435 | product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks. |
CVE-2005-0408 | chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass. |
Phase: Architecture and Design Strategy: Libraries or Frameworks Use an authentication framework or library such as the OWASP ESAPI Authentication feature. |
Nature | Type | ID | Name | View(s) this relationship pertains to |
---|---|---|---|---|
ChildOf | Category | 254 | Security Features | Development Concepts (primary)699 |
ChildOf | Weakness Class | 693 | Protection Mechanism Failure | Research Concepts (primary)1000 |
ChildOf | Category | 718 | OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management | Weaknesses in OWASP Top Ten (2007) (primary)629 |
ChildOf | Category | 724 | OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management | Weaknesses in OWASP Top Ten (2004) (primary)711 |
ParentOf | Weakness Class | 300 | Channel Accessible by Non-Endpoint ('Man-in-the-Middle') | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Variant | 301 | Reflection Attack in an Authentication Protocol | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 303 | Incorrect Implementation of Authentication Algorithm | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 304 | Missing Critical Step in Authentication | Development Concepts (primary)699 |
ParentOf | Weakness Variant | 306 | Missing Authentication for Critical Function | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 307 | Improper Restriction of Excessive Authentication Attempts | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 308 | Use of Single-factor Authentication | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 309 | Use of Password System for Primary Authentication | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 322 | Key Exchange without Entity Authentication | Research Concepts (primary)1000 |
ParentOf | Compound Element: Composite | 384 | Session Fixation | Development Concepts699 Research Concepts (primary)1000 |
ParentOf | Weakness Class | 592 | Authentication Bypass Issues | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 603 | Use of Client-Side Authentication | Development Concepts (primary)699 Research Concepts1000 |
ParentOf | Weakness Base | 645 | Overly Restrictive Account Lockout Mechanism | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | Weakness Base | 798 | Use of Hard-coded Credentials | Research Concepts (primary)1000 |
ParentOf | Weakness Base | 804 | Guessable CAPTCHA | Development Concepts699 Research Concepts1000 |
MemberOf | View | 635 | Weaknesses Used by NVD | Weaknesses Used by NVD (primary)635 |
CanFollow | Weakness Base | 304 | Missing Critical Step in Authentication | Research Concepts1000 |
CanFollow | Weakness Base | 613 | Insufficient Session Expiration | Development Concepts699 Research Concepts1000 |
Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
---|---|---|---|
PLOVER | Authentication Error | ||
OWASP Top Ten 2007 | A7 | CWE More Specific | Broken Authentication and Session Management |
OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |
WASC | 1 | Insufficient Authentication |
OWASP. "Top 10 2007-Broken Authentication and Session Management". <http://www.owasp.org/index.php/Top_10_2007-A7>. |
OWASP. "Guide to Authentication". <http://www.owasp.org/index.php/Guide_to_Authentication>. |
Microsoft. "Authentication". <http://msdn.microsoft.com/en-us/library/aa374735(VS.85).aspx>. |
[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 4, "Authentication" Page 109. 2nd Edition. Microsoft. 2002. |
Submissions | ||||
---|---|---|---|---|
Submission Date | Submitter | Organization | Source | |
PLOVER | Externally Mined | |||
Modifications | ||||
Modification Date | Modifier | Organization | Source | |
2008-07-01 | Eric Dalci | Cigital | External | |
updated Time of Introduction | ||||
2008-08-15 | Veracode | External | ||
Suggested OWASP Top Ten 2004 mapping | ||||
2008-09-08 | CWE Content Team | MITRE | Internal | |
updated Alternate Terms, Common Consequences, Relationships, Relationship Notes, Taxonomy Mappings | ||||
2008-10-14 | CWE Content Team | MITRE | Internal | |
updated Relationships | ||||
2009-01-12 | CWE Content Team | MITRE | Internal | |
updated Name | ||||
2009-05-27 | CWE Content Team | MITRE | Internal | |
updated Description, Related Attack Patterns | ||||
2009-07-27 | CWE Content Team | MITRE | Internal | |
updated Relationships | ||||
2009-10-29 | CWE Content Team | MITRE | Internal | |
updated Common Consequences, Observed Examples | ||||
2009-12-28 | CWE Content Team | MITRE | Internal | |
updated Applicable Platforms, Common Consequences, Demonstrative Examples, Detection Factors, Likelihood of Exploit, References | ||||
Previous Entry Names | ||||
Change Date | Previous Entry Name | |||
2008-04-11 | Authentication Issues | |||
2009-01-12 | Insufficient Authentication | |||