1655
However, the attacker can set the "authenticated" cookie to a non-zero value such as 1. As a
result, the $auth variable is 1, and the AuthenticateUser() check is not even performed. The
attacker has bypassed the authentication.
Example 3:
In the following example, an authentication flag is read from a browser cookie, thus allowing for
external control of user state data.
Example Language: Java (Bad)
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("authenticated") && Boolean.TRUE.equals(c.getValue())) {
authenticated = true;
}
}
Observed Examples
Reference Description
CVE-2009-1549 Attacker can bypass authentication by setting a cookie to a specific value.
https://www.cve.org/CVERecord?id=CVE-2009-1549
CVE-2009-1619 Attacker can bypass authentication and gain admin privileges by setting an
"admin" cookie to 1.
https://www.cve.org/CVERecord?id=CVE-2009-1619
CVE-2009-0864 Content management system allows admin privileges by setting a "login"
cookie to "OK."
https://www.cve.org/CVERecord?id=CVE-2009-0864
CVE-2008-5784 e-dating application allows admin privileges by setting the admin cookie to 1.
https://www.cve.org/CVERecord?id=CVE-2008-5784
CVE-2008-6291 Web-based email list manager allows attackers to gain admin privileges by
setting a login cookie to "admin."
https://www.cve.org/CVERecord?id=CVE-2008-6291
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Maintenance
A new parent might need to be defined for this entry. This entry is specific to cookies, which
reflects the significant number of vulnerabilities being reported for cookie-based authentication
in CVE during 2008 and 2009. However, other types of inputs - such as parameters or headers -
could also be used for similar authentication or authorization. Similar issues (under the Research
view) include CWE-247 and CWE-472.
References
[REF-706]Steve Christey. "Unforgivable Vulnerabilities". 2007 August 2. < http://cve.mitre.org/docs/
docs-2007/unforgivable.pdf >.
CWE Version 4.14
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer