Insufficiently Protected Credentials

Opis

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Skutki

• Access Control

  Gain Privileges or Assume Identity

  An attacker could gain access to user accounts and access sensitive data used by the user accounts.

Zapobieganie

• Architecture and Design

  Use an appropriate security mechanism to protect the credentials.

• Architecture and Design

  Make appropriate use of cryptography to protect the credentials.

• Implementation

  Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Przykłady podatności

• CVE-2022-30018 A messaging platform serializes all elements of User/Group objects, making private information available to adversaries
• CVE-2022-29959 Initialization file contains credentials that can be decoded using a "simple string transformation"
• CVE-2022-35411 Python-based RPC framework enables pickle functionality by default, allowing clients to unpickle untrusted data.
• CVE-2022-29519 Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens.
• CVE-2022-30312 Building Controller uses a protocol that transmits authentication credentials in plaintext.
• CVE-2022-31204 Programmable Logic Controller (PLC) sends password in plaintext.
• CVE-2022-30275 Remote Terminal Unit (RTU) uses a driver that relies on a password stored in plaintext.
• CVE-2007-0681 Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
• CVE-2000-0944 Web application password change utility doesn't check the original password.
• CVE-2005-3435 product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
• CVE-2005-0408 chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.

Słabość nadrzędna

• CWE-1390 Weak Authentication
• CWE-287 Improper Authentication
• CWE-668 Exposure of Resource to Wrong Sphere

Słabości podrzędne

• CWE-256 Plaintext Storage of a Password
• CWE-257 Storing Passwords in a Recoverable Format
• CWE-260 Password in Configuration File
• CWE-261 Weak Encoding for Password
• CWE-523 Unprotected Transport of Credentials
• CWE-549 Missing Password Field Masking

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based, ICS/OT

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 19: Use of Weak Password-Based Systems." Page 279, McGraw-Hill, 2010
2. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022