CWE

CWE-287 – Improper Authentication

Read Time:1 Minute, 38 Second

Description

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-284
CWE-284

 

Consequences

Integrity, Confidentiality, Availability, Access Control: Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

CVE References

  • CVE-2009-3421
    • login script for guestbook allows bypassing authentication by setting a “login_ok” parameter to 1.
  • CVE-2009-2382
    • admin script allows authentication bypass by setting a cookie value to “LOGGEDIN”.
  • CVE-2009-1048
    • VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
  • CVE-2009-2213
    • product uses default “Allow” action, instead of default deny, leading to authentication bypass.
  • CVE-2009-2168
    • chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
  • CVE-2009-3107
    • product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
  • CVE-2009-1596
    • product does not properly implement a security-related configuration setting, allowing authentication bypass.
  • CVE-2009-2422
    • authentication routine returns “nil” instead of “false” in some situations, allowing authentication bypass using an invalid username.
  • CVE-2009-3232
    • authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
  • CVE-2009-3231
    • use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
  • CVE-2005-3435
    • product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
  • CVE-2005-0408
    • chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.