When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
Alternate Terms
authentification:
An alternate term is "authentification", which appears to be most
commonly used by people from non-English-speaking countries.
AuthC:
"AuthC" is typically used as an abbreviation of "authentication"
within the web application security community. It is also distinct from
"AuthZ," which is an abbreviation of "authorization." The use of "Auth"
as an abbreviation is discouraged, since it could be used for either
authentication or authorization.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Language-independent
Common Consequences
Scope
Effect
Integrity
Confidentiality
Availability
Access Control
Technical Impact: Read application
data; Gain privileges / assume
identity; Execute unauthorized code or
commands
This weakness can lead to the exposure of resources or functionality
to unintended actors, possibly providing attackers with sensitive
information or even execute arbitrary code.
Likelihood of Exploit
Medium to High
Detection Methods
Automated Static Analysis
Automated static analysis is useful for detecting certain types of
authentication. A tool may be able to analyze related configuration
files, such as .htaccess in Apache web servers, or detect the usage of
commonly-used authentication libraries.
Generally, automated static analysis tools have difficulty detecting
custom authentication schemes. In addition, the software's design may
include some functionality that is accessible to any user and does not
require an established identity; an automated technique that detects the
absence of authentication may report false positives.
Effectiveness: Limited
Manual Static Analysis
This weakness can be detected using tools and techniques that require
manual (human) analysis, such as penetration testing, threat modeling,
and interactive tools that allow the tester to record and modify an
active session.
Manual static analysis is useful for evaluating the correctness of
custom authentication mechanisms.
Effectiveness: High
These may be more effective than strictly automated techniques. This
is especially the case with weaknesses that are related to design and
business rules.
Manual Static Analysis - Binary / Bytecode
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for
vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with automated results
interpretation
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with manual results interpretation
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Automated Static Analysis
According to SOAR, the following detection techniques may be
useful:
Cost effective for partial coverage:
Configuration Checker
Effectiveness: SOAR Partial
Architecture / Design Review
According to SOAR, the following detection techniques may be
useful:
The following code intends to ensure that the user is already logged
in. If not, the code performs authentication with the user-provided username
and password. If successful, it sets the loggedin and user cookies to
"remember" that the user has already logged in. Finally, the code performs
administrator tasks if the logged-in user has the "Administrator" username,
as recorded in the user cookie.
(Bad Code)
Example
Language: Perl
my $q = new CGI;
if ($q->cookie('loggedin') ne "true") {
if (! AuthenticateUser($q->param('username'),
$q->param('password'))) {
ExitError("Error: you need to log in first");
}
else {
# Set loggedin and user cookies.
$q->cookie(
-name => 'loggedin',
-value => 'true'
);
$q->cookie(
-name => 'user',
-value => $q->param('username')
);
}
}
if ($q->cookie('user') eq "Administrator") {
DoAdministratorTasks();
}
Unfortunately, this code can be bypassed. The attacker can set the
cookies independently so that the code does not check the username and
password. The attacker could do this with an HTTP request containing
headers such as:
(Attack)
GET /cgi-bin/vulnerable.cgi HTTP/1.1
Cookie: user=Administrator
Cookie: loggedin=true
[body of request]
By setting the loggedin cookie to "true", the attacker bypasses the
entire authentication check. By using the "Administrator" value in the
user cookie, the attacker also gains privileges to administer the
software.
Example 2
In January 2009, an attacker was able to gain administrator access
to a Twitter server because the server did not restrict the number of login
attempts. The attacker targeted a member of Twitter's support team and was
able to successfully guess the member's password using a brute force with a
large number of common words. Once the attacker gained access as the member
of the support staff, he used the administrator panel to gain access to 33
accounts that belonged to celebrities and politicians. Ultimately, fake
Twitter messages were sent that appeared to come from the compromised
accounts.
More information is available — Please select a different filter.
Page Last Updated:
January 18, 2017
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
[email protected].
Description
