Tag Archives: Missing Authentication for Critical Function

CWE-306 – Missing Authentication for Critical Function

Read Time:1 Minute, 16 Second

Description

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-287
CWE-287

 

Consequences

Access Control, Other: Gain Privileges or Assume Identity, Other

Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, access to administrative or other privileged functionality, or possibly even execution of arbitrary code.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Phase: Architecture and Design

Description: 

Phase: Architecture and Design

Description: 

CVE References

  • CVE-2002-1810
    • MFV. Access TFTP server without authentication and obtain configuration file with sensitive plaintext information.
  • CVE-2008-6827
    • Agent software running at privileges does not authenticate incoming requests over an unprotected channel, allowing a Shatter” attack.
  • CVE-2004-0213
    • Product enforces restrictions through a GUI but not through privileged APIs.
  • CVE-2020-15483
    • monitor device allows access to physical UART debug port without authentication