All posts by rocco

CWE

CWE-305 – Authentication Bypass by Primary Weakness

Read Time:40 Second

Description

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-287

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

CVE References

  • CVE-2002-1374
    • The provided password is only compared against the first character of the real password.
  • CVE-2000-0979
    • The password is not properly checked, which allows remote attackers to bypass access controls by sending a 1-byte password that matches the first character of the real password.
  • CVE-2001-0088
    • Chain: Forum software does not properly initialize an array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the password and gain administrative privileges.
CWE

CWE-306 – Missing Authentication for Critical Function

Read Time:1 Minute, 16 Second

Description

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-287
CWE-287

 

Consequences

Access Control, Other: Gain Privileges or Assume Identity, Other

Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, access to administrative or other privileged functionality, or possibly even execution of arbitrary code.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

CVE References

  • CVE-2002-1810
    • MFV. Access TFTP server without authentication and obtain configuration file with sensitive plaintext information.
  • CVE-2008-6827
    • Agent software running at privileges does not authenticate incoming requests over an unprotected channel, allowing a Shatter” attack.
  • CVE-2004-0213
    • Product enforces restrictions through a GUI but not through privileged APIs.
  • CVE-2020-15483
    • monitor device allows access to physical UART debug port without authentication
CWE

CWE-307 – Improper Restriction of Excessive Authentication Attempts

Read Time:50 Second

Description

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-287
CWE-287
CWE-799

 

Consequences

Access Control: Bypass Protection Mechanism

An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

CVE References

  • CVE-1999-1152
    • Product does not disconnect or timeout after multiple failed logins.
  • CVE-2001-1291
    • Product does not disconnect or timeout after multiple failed logins.
  • CVE-2001-0395
    • Product does not disconnect or timeout after multiple failed logins.
  • CVE-2001-1339
    • Product does not disconnect or timeout after multiple failed logins.
  • CVE-2002-0628
    • Product does not disconnect or timeout after multiple failed logins.
  • CVE-1999-1324
    • User accounts not disabled when they exceed a threshold; possibly a resultant problem.
CWE

CWE-308 – Use of Single-factor Authentication

Read Time:54 Second

Description

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy. The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-287
CWE-654
CWE-309

 

Consequences

Access Control: Bypass Protection Mechanism

If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Use multiple independent authentication schemes, which ensures that — if one of the methods is compromised — the system itself is still likely safe from compromise.

CVE References

CWE

CWE-309 – Use of Password System for Primary Authentication

Read Time:1 Minute, 6 Second

Description

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

Password systems are the simplest and most ubiquitous authentication mechanisms. However, they are subject to such well known attacks,and such frequent compromise that their use in the most simple implementation is not practical.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-287
CWE-654
CWE-308

 

Consequences

Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

A password authentication mechanism error will almost always result in attackers being authorized as valid users.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

Use a zero-knowledge password protocol, such as SRP.

Phase: Architecture and Design

Description: 

Ensure that passwords are stored safely and are not reversible.

Phase: Architecture and Design

Description: 

Implement password aging functionality that requires passwords be changed after a certain point.

Phase: Architecture and Design

Description: 

Use a mechanism for determining the strength of a password and notify the user of weak password use.

Phase: Architecture and Design

Description: 

Inform the user of why password protections are in place, how they work to protect data integrity, and why it is important to heed their warnings.

CVE References

CWE

CWE-31 – Path Traversal: ‘dir….filename’

Read Time:48 Second

Description

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘dir….filename’ (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-23

 

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

 

Potential Mitigations

Phase: Implementation

Description: 

Phase: Implementation

Description: 

Inputs should be decoded and canonicalized to the application’s current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

CVE References

  • CVE-2002-0160
    • The administration function in Access Control Server allows remote attackers to read HTML, Java class, and image files outside the web root via a “….” sequence in the URL to port 2002.
CWE

CWE-311 – Missing Encryption of Sensitive Data

Read Time:3 Minute, 23 Second

Description

The software does not encrypt sensitive or critical information before storage or transmission.

The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-693

 

Consequences

Confidentiality: Read Application Data

If the application does not use a secure channel, such as SSL, to exchange sensitive information, it is possible for an attacker with access to the network traffic to sniff packets from the connection and uncover the data. This attack is not technically difficult, but does require physical access to some portion of the network over which the sensitive data travels. This access is usually somewhere near where the user is connected to the network (such as a colleague on the company network) but can be anywhere along the path from the user to the end server.

Confidentiality, Integrity: Modify Application Data

Omitting the use of encryption in any program which transfers data over a network of any kind should be considered on par with delivering the data sent to each user on the local networks of both the sender and receiver. Worse, this omission allows for the injection of data into a stream of communication between two parties — with no means for the victims to separate valid data from invalid. In this day of widespread network attacks and password collection sniffers, it is an unnecessary risk to omit encryption from the design of any system which might benefit from it.

 

Potential Mitigations

Phase: Requirements

Description: 

Clearly specify which data or resources are valuable enough that they should be protected by encryption. Require that any transmission or storage of this data/resource should use well-vetted encryption algorithms.

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

Phase: Implementation, Architecture and Design

Description: 

When using industry-approved techniques, use them correctly. Don’t cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.

Phase: Implementation

Effectiveness: Defense in Depth

Description: 

Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.

This makes it easier to spot places in the code where data is being used that is unencrypted.

CVE References

  • CVE-2009-2272
    • password and username stored in cleartext in a cookie
  • CVE-2009-1466
    • password stored in cleartext in a file with insecure permissions
  • CVE-2009-0152
    • chat program disables SSL in some circumstances even when the user says to use SSL.
  • CVE-2009-1603
    • Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption
  • CVE-2008-1567
    • storage of a secret key in cleartext in a temporary file
  • CVE-2008-0174
    • SCADA product uses HTTP Basic Authentication, which is not encrypted
  • CVE-2007-5778
    • login credentials stored unencrypted in a registry key
  • CVE-2008-4122
    • Chain: Use of HTTPS cookie without “secure” flag causes it to be transmitted across unencrypted HTTP.
  • CVE-2008-3289
    • Product sends password hash in cleartext in violation of intended policy.
  • CVE-2008-4390
    • Remote management feature sends sensitive information including passwords in cleartext.
  • CVE-2007-5626
    • Backup routine sends password in cleartext in email.
  • CVE-2004-1852
    • Product transmits Blowfish encryption key in cleartext.
  • CVE-2008-0374
    • Printer sends configuration information, including administrative password, in cleartext.
  • CVE-2007-4961
    • Chain: cleartext transmission of the MD5 hash of password enables attacks against a server that is susceptible to replay (CWE-294).
  • CVE-2007-4786
    • Product sends passwords in cleartext to a log server.
  • CVE-2005-3140
    • Product sends file with cleartext passwords in e-mail message intended for diagnostic purposes.
CWE

CWE-312 – Cleartext Storage of Sensitive Information

Read Time:1 Minute, 42 Second

Description

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Because the information is stored in cleartext, attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-311
CWE-311
CWE-922

 

Consequences

Confidentiality: Read Application Data

An attacker with access to the system could read sensitive information stored in cleartext.

 

Potential Mitigations

CVE References

  • CVE-2009-2272
    • password and username stored in cleartext in a cookie
  • CVE-2009-1466
    • password stored in cleartext in a file with insecure permissions
  • CVE-2009-0152
    • chat program disables SSL in some circumstances even when the user says to use SSL.
  • CVE-2009-1603
    • Chain: product uses an incorrect public exponent when generating an RSA key, which effectively disables the encryption
  • CVE-2008-1567
    • storage of a secret key in cleartext in a temporary file
  • CVE-2008-0174
    • SCADA product uses HTTP Basic Authentication, which is not encrypted
  • CVE-2007-5778
    • login credentials stored unencrypted in a registry key
  • CVE-2002-1696
    • Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message.
  • CVE-2004-2397
    • Plaintext storage of private key and passphrase in log file when user imports the key.
  • CVE-2001-1537
    • Default configuration has cleartext usernames/passwords in cookie.
  • CVE-2005-2160
    • Authentication information stored in cleartext in a cookie.
CWE

CWE-313 – Cleartext Storage in a File or on Disk

Read Time:47 Second

Description

The application stores sensitive information in cleartext in a file, or on disk.

The sensitive information could be read by attackers with access to the file, or with physical or administrator access to the raw disk. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-312

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

CVE References

  • CVE-2002-1696
    • Decrypted copy of a message written to disk given a combination of options and when user replies to an encrypted message.
  • CVE-2004-2397
    • Cleartext storage of private key and passphrase in log file when user imports the key.
CWE

CWE-314 – Cleartext Storage in the Registry

Read Time:24 Second

Description

The application stores sensitive information in cleartext in the registry.

Attackers can read the information by accessing the registry key. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-312

 

Consequences

Confidentiality: Read Application Data

 

Potential Mitigations

CVE References