Weak Authentication

Opis

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attackers may be able to bypass weak authentication faster and/or with less effort than expected.

Skutki

• Integrity, Confidentiality, Availability, Access Control

  Read Application Data; Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands

  This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Przykłady podatności

• CVE-2024-48445 Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390)
• CVE-2022-30034 Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).
• CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication
• CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)
• CVE-2022-29965 Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
• CVE-2022-29959 Initialization file contains credentials that can be decoded using a "simple string transformation"
• CVE-2020-8994 UART interface for AI speaker uses empty password for root shell

Słabość nadrzędna

• CWE-287 Improper Authentication

Słabości podrzędne

• CWE-41 Improper Resolution of Path Equivalence
• CWE-262 Not Using Password Aging
• CWE-263 Password Aging with Long Expiration
• CWE-289 Authentication Bypass by Alternate Name
• CWE-290 Authentication Bypass by Spoofing
• CWE-294 Authentication Bypass by Capture-replay
• CWE-301 Reflection Attack in an Authentication Protocol
• CWE-302 Authentication Bypass by Assumed-Immutable Data
• CWE-303 Incorrect Implementation of Authentication Algorithm
• CWE-305 Authentication Bypass by Primary Weakness
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-308 Use of Single-factor Authentication
• CWE-309 Use of Password System for Primary Authentication
• CWE-522 Insufficiently Protected Credentials
• CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
• CWE-603 Use of Client-Side Authentication
• CWE-620 Unverified Password Change
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password
• CWE-804 Guessable CAPTCHA
• CWE-836 Use of Password Hash Instead of Password for Authentication
• CWE-1391 Use of Weak Credentials

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, ICS/OT, Not Technology-Specific

Źródła

1. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022