734
Medium
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
The primary result of reflection attacks is successful
authentication with a target machine -- as an impersonated
user.
Potential Mitigations
Phase: Architecture and Design
Use different keys for the initiator and responder or of a different type of challenge for the initiator
and responder.
Phase: Architecture and Design
Let the initiator prove its identity before proceeding.
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: C (Bad)
unsigned char *simple_digest(char *alg,char *buf,unsigned int len, int *olen) {
const EVP_MD *m;
EVP_MD_CTX ctx;
unsigned char *ret;
OpenSSL_add_all_digests();
if (!(m = EVP_get_digestbyname(alg))) return NULL;
if (!(ret = (unsigned char*)malloc(EVP_MAX_MD_SIZE))) return NULL;
EVP_DigestInit(&ctx, m);
EVP_DigestUpdate(&ctx,buf,len);
EVP_DigestFinal(&ctx,ret,olen);
return ret;
}
unsigned char *generate_password_and_cmd(char *password_and_cmd) {
simple_digest("sha1",password,strlen(password_and_cmd)
...
);
}
Example Language: Java (Bad)
String command = new String("some cmd to execute & the password") MessageDigest encer =
MessageDigest.getInstance("SHA");
encer.update(command.getBytes("UTF-8"));
byte[] digest = encer.digest();
Observed Examples
Reference Description
CVE-2005-3435 product authentication succeeds if user-provided MD5 hash matches the hash
in its database; this can be subjected to replay attacks.
https://www.cve.org/CVERecord?id=CVE-2005-3435
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-302: Authentication Bypass by Assumed-Immutable Data
CWE-302: Authentication Bypass by Assumed-Immutable Data