753
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
If the secret in a single-factor authentication scheme gets
compromised, full authentication is possible.
Potential Mitigations
Phase: Architecture and Design
Use multiple independent authentication schemes, which ensures that -- if one of the methods is
compromised -- the system itself is still likely safe from compromise.
Demonstrative Examples
Example 1:
In both of these examples, a user is logged in if their given password matches a stored password:
Example Language: C (Bad)
unsigned char *check_passwd(char *plaintext) {
ctext = simple_digest("sha1",plaintext,strlen(plaintext), ... );
//Login if hash matches stored hash
if (equal(ctext, secret_password())) {
login_user();
}
}
Example Language: Java (Bad)
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("SHA");
encer.update(plainTextIn);
byte[] digest = password.digest();
//Login if hash matches stored hash
if (equal(digest,secret_password())) {
login_user();
}
This code relies exclusively on a password mechanism (CWE-309) using only one factor of
authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full
access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also
does not use a salt (CWE-759).
Observed Examples
Reference Description
CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is
enabled, effectively removing the second factor from two-factor authentication
https://www.cve.org/CVERecord?id=CVE-2022-35248
MemberOf Relationships
CWE Version 4.14
CWE-309: Use of Password System for Primary Authentication
CWE-309: Use of Password System for Primary Authentication