CWE-287 认证机制不恰当
Improper Authentication
结构: Simple
Abstraction: Class
状态: Draft
被利用可能性: High
基本描述
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 284 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 284 cwe_View_ID: 699 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Integrity', 'Confidentiality', 'Availability', 'Access Control'] | ['Read Application Data', 'Gain Privileges or Assume Identity', 'Execute Unauthorized Code or Commands'] | This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. |
检测方法
DM-6 Automated Static Analysis
Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries.
Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.
DM-7 Manual Static Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful:
- Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Web Application Scanner
- Web Services Scanner
- Database Scanners
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Fuzz Tester
- Framework-based Fuzzer
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Manual Source Code Review (not inspections)
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Source code Weakness Analyzer
- Context-configured Source Code Weakness Analyzer
Automated Static Analysis
According to SOAR, the following detection techniques may be useful:
- Configuration Checker
Architecture or Design Review
According to SOAR, the following detection techniques may be useful:
- Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
- Formal Methods / Correct-By-Construction
可能的缓解方案
Architecture and Design
策略: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
示例代码
例
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
bad Perl
if ($q->cookie('loggedin') ne "true") {
}
else {
$q->cookie(
-value => 'true'
);
$q->cookie(
-value => $q->param('username')
);
}
}
if ($q->cookie('user') eq "Administrator") {
}
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:
attack
Cookie: user=Administrator
Cookie: loggedin=true
[body of request]
By setting the loggedin cookie to "true", the attacker bypasses the entire authentication check. By using the "Administrator" value in the user cookie, the attacker also gains privileges to administer the software.
例
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2009-3421 | login script for guestbook allows bypassing authentication by setting a "login_ok" parameter to 1. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3421 |
| CVE-2009-2382 | admin script allows authentication bypass by setting a cookie value to "LOGGEDIN". | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2382 |
| CVE-2009-1048 | VOIP product allows authentication bypass using 127.0.0.1 in the Host header. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1048 |
| CVE-2009-2213 | product uses default "Allow" action, instead of default deny, leading to authentication bypass. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2213 |
| CVE-2009-2168 | chain: redirect without exit (CWE-698) leads to resultant authentication bypass. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2168 |
| CVE-2009-3107 | product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3107 |
| CVE-2009-1596 | product does not properly implement a security-related configuration setting, allowing authentication bypass. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1596 |
| CVE-2009-2422 | authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2422 |
| CVE-2009-3232 | authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3232 |
| CVE-2009-3231 | use of LDAP authentication with anonymous binds causes empty password to result in successful authentication | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3231 |
| CVE-2005-3435 | product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3435 |
| CVE-2005-0408 | chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0408 |
Notes
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Authentication Error | ||
| OWASP Top Ten 2007 | A7 | CWE More Specific | Broken Authentication and Session Management |
| OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |
| WASC | 1 | Insufficient Authentication |
相关攻击模式
- CAPEC-114
- CAPEC-115
- CAPEC-151
- CAPEC-194
- CAPEC-22
- CAPEC-57
- CAPEC-593
- CAPEC-633
- CAPEC-650
- CAPEC-94
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论