CWE-620 未经验证的口令修改
Unverified Password Change
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: unkown
基本描述
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
扩展描述
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Access Control | ['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity'] |
可能的缓解方案
Architecture and Design
策略:
When prompting for a password change, force the user to provide the original password in addition to the new password.
Architecture and Design
策略:
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
示例代码
例
This code changes a user's password.
bad PHP
$pass = $_GET['pass'];
$checkpass = $_GET['checkpass'];
if ($pass == $checkpass) {
}
While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2007-0681 | Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0681 |
| CVE-2000-0944 | Web application password change utility doesn't check the original password. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0944 |
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| OWASP Top Ten 2004 | A3 | CWE More Specific | Broken Authentication and Session Management |
| Software Fault Patterns | SFP31 | Missing authentication |
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论