CWE-620 未经验证的口令修改

Unverified Password Change

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

扩展描述

This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Architecture and Design

策略:

When prompting for a password change, force the user to provide the original password in addition to the new password.

Architecture and Design

策略:

Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.

示例代码

例

This code changes a user's password.

bad PHP

While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.

分析过的案例

分类映射

引用

• REF-44 24 Deadly Sins of Software Security

文章来源于互联网:scap中文网