Use of Single-factor Authentication

Opis

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Skutki

• Access Control

  Bypass Protection Mechanism

  If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

Zapobieganie

• Architecture and Design

  Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

Przykłady podatności

• CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication

Słabość nadrzędna

• CWE-1390 Weak Authentication
• CWE-654 Reliance on a Single Factor in a Security Decision

Pokrewna

• CWE-309 Use of Password System for Primary Authentication

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy. The use of weak, reused, and common passwords is rampant on the internet.

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005