Authentication Bypass by Spoofing

Opis

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Skutki

• Access Control

  Bypass Protection Mechanism; Gain Privileges or Assume Identity

  This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.

Przykłady podatności

• CVE-2022-30319 S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
• CVE-2009-1048 VOIP product allows authentication bypass using 127.0.0.1 in the Host header.

Słabość nadrzędna

• CWE-1390 Weak Authentication
• CWE-287 Improper Authentication

Słabości podrzędne

• CWE-291 Reliance on IP Address for Authentication
• CWE-293 Using Referer Field for Authentication
• CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action

Kiedy powstaje

• Implementation
• Architecture and Design

Dotyczy

Not Language-Specific

Uwagi

This can be resultant from insufficient verification.

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 3, "Spoofing and Identification", Page 72, Addison Wesley, 2006