CWE-836 在认证机制中使用口令哈希代替口令

Use of Password Hash Instead of Password for Authentication

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

扩展描述

Some authentication mechanisms rely on the client to generate the hash for a password, possibly to reduce load on the server or avoid sending the password across the network. However, when the client is used to generate the hash, an attacker can bypass the authentication by obtaining a copy of the hash, e.g. by using SQL injection to compromise a database of authentication credentials, or by exploiting an information exposure. The attacker could then use a modified client to replay the stolen hash without having knowledge of the original password.

As a result, the server-side comparison against a client-side hash does not provide any more security than the use of passwords without hashing.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: PeerOf cwe_CWE_ID: 602 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Access Control	['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity']	An attacker could bypass the authentication routine without knowing the original password.

分析过的案例

标识	说明	链接
CVE-2009-1283	Product performs authentication with user-supplied password hashes that can be obtained from a separate SQL injection vulnerability (CVE-2009-1282).	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1283
CVE-2005-3435	Product allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3435

文章来源于互联网:scap中文网