Missing Critical Step in Authentication

Opis

The product implements an authentication technique, but it skips a step that weakens the technique.

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Skutki

• Access Control, Integrity, Confidentiality

  Bypass Protection Mechanism; Gain Privileges or Assume Identity; Read Application Data; Execute Unauthorized Code or Commands

  This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.

Przykłady podatności

• CVE-2004-2163 Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
• CVE-2005-3327 Chain: Authentication bypass by skipping the first startup step as required by the protocol.

Słabość nadrzędna

• CWE-303 Incorrect Implementation of Authentication Algorithm
• CWE-573 Improper Following of Specification by Caller

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific