Key Exchange without Entity Authentication

Opis

The product performs a key exchange with an actor without verifying the identity of that actor.

Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable an attacker to impersonate an actor by modifying traffic between the two entities. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.

Skutki

• Access Control

  Bypass Protection Mechanism

  No authentication takes place in this process, bypassing an assumed protection of encryption.

• Confidentiality

  Read Application Data

  The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.

Zapobieganie

• Architecture and Design

  Ensure that proper authentication is included in the system design.

• Implementation

  Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Słabość nadrzędna

• CWE-306 Missing Authentication for Critical Function

Może prowadzić do

• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Pokrewna

• CWE-295 Improper Certificate Validation

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Dotyczy

Not Language-Specific

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 23: Improper Use of PKI, Especially SSL." Page 347, McGraw-Hill, 2010
3. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 2, "Untrustworthy Credentials", Page 37, Addison Wesley, 2006