用户工具

站点工具


cwe:cn:definition:287

CWE-287:认证机制不恰当

Description Summary

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Likelihood of Exploit

Medium to High

Common Consequences

Scope Technical Impace Note
Integrity
Confidentiality
Availability
Access_Control
Read application data
Gain privileges / assume identity
Execute unauthorized code or commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Detection Methods

Detection Method - 1

Automated Static Analysis

Automated static analysis is useful for detecting commonly-used idioms for authorization. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authorization libraries.

Generally, automated static analysis tools have difficulty detecting custom authorization schemes. Even if they can be customized to recognize these schemes, they might not be able to tell whether the scheme correctly performs the authorization in a way that cannot be bypassed or subverted by an attacker.

2013/05/30 09:37

Detection Method - 2

Manual Analysis

This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.

Specifically, manual analysis can be useful for finding this weakness, and for minimizing false positives assuming an understanding of business logic. However, it might not achieve desired code coverage within limited time constraints. For black-box analysis, if credentials are not known for privileged accounts, then the most security-critical portions of the application may not receive sufficient attention.

Consider using OWASP CSRFTester to identify potential issues and aid in manual analysis.

These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
2013/05/30 09:37

Detection Method - 3

Manual Static Analysis - Binary / Bytecode

According to SOAR, the following detection techniques may be useful:

Detection Method - 4

=== Dynamic Analysis with automated results interpretation === According to SOAR, the following detection techniques may be useful:

Detection Method - 5

Dynamic Analysis with manual results interpretation

According to SOAR, the following detection techniques may be useful:

Detection Method - 6

Manual Static Analysis - Source Code

According to SOAR, the following detection techniques may be useful:

Detection Method - 7

Automated Static Analysis - Source Code

According to SOAR, the following detection techniques may be useful:

Detection Method - 8

Automated Static Analysis

According to SOAR, the following detection techniques may be useful:

Detection Method - 9

Architecture / Design Review

According to SOAR, the following detection techniques may be useful:

Potential Mitigations

Mitigation - 1

Architecture and Design

Strategy:Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Demonstrative Examples

Example - 1

The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to “remember” that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the “Administrator” username, as recorded in the user cookie.

my $q = new CGI; 
 
if ($q->cookie('loggedin') ne "true") { 
if (! AuthenticateUser($q->param('username'), $q->param('password'))) { 
ExitError("Error: you need to log in first"); 
 
} 
else { 
# Set loggedin and user cookies. 
$q->cookie( 
-name => 'loggedin', 
-value => 'true' 
); 
 
$q->cookie( 
-name => 'user', 
-value => $q->param('username') 
); 
 
 
} 
 
} 
 
if ($q->cookie('user') eq "Administrator") { 
DoAdministratorTasks(); 
 
} 

Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:

GET /cgi-bin/vulnerable.cgi HTTP/1.1 
Cookie: user=Administrator 
Cookie: loggedin=true 

[body of request] 

By setting the loggedin cookie to “true”, the attacker bypasses the entire authentication check. By using the “Administrator” value in the user cookie, the attacker also gains privileges to administer the software.

Example - 2

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

Observed Examples

Reference Description
CVE-2009-3421login script for guestbook allows bypassing authentication by setting a “login_ok” parameter to 1.
CVE-2009-2382admin script allows authentication bypass by setting a cookie value to “LOGGEDIN”.
CVE-2009-1048VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
CVE-2009-2213product uses default “Allow” action, instead of default deny, leading to authentication bypass.
CVE-2009-2168chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
CVE-2009-3107product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
CVE-2009-1596product does not properly implement a security-related configuration setting, allowing authentication bypass.
CVE-2009-2422authentication routine returns “nil” instead of “false” in some situations, allowing authentication bypass using an invalid username.
CVE-2009-3232authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
CVE-2009-3231use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
CVE-2005-3435product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
CVE-2005-0408chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.
cwe/cn/definition/287.txt · 最后更改: 2014/09/04 14:31 (外部编辑)