1224
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
An attacker could easily guess user passwords and gain
access user accounts.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
A product's design should require adherance to an appropriate password policy. Specific
password requirements depend strongly on contextual factors, but it is recommended to contain
the following attributes: Enforcement of a minimum and maximum length Restrictions against
password reuse Restrictions against using common passwords Restrictions against using
contextual string in the password (e.g., user id, app name) Depending on the threat model,
the password policy may include several additional attributes. Complex passwords requiring
mixed character sets (alpha, numeric, special, mixed case) Increasing the range of characters
makes the password harder to crack and may be appropriate for systems relying on single factor
authentication. Unfortunately, a complex password may be difficult to memorize, encouraging a
user to select a short password or to incorrectly manage the password (write it down). Another
disadvantage of this approach is that it often does not result in a significant increases in overal
password complexity due to people's predictable usage of various symbols. Large Minimum
Length (encouraging passphrases instead of passwords) Increasing the number of characters
makes the password harder to crack and may be appropriate for systems relying on single factor
authentication. A disadvantage of this approach is that selecting a good passphrase is not easy
and poor passwords can still be generated. Some prompting may be needed to encourage
long un-predictable passwords. Randomly Chosen Secrets Generating a password for the
user can help make sure that length and complexity requirements are met, and can result in
secure passwords being used. A disadvantage of this approach is that the resulting password or
passpharse may be too difficult to memorize, encouraging them to be written down. Password
Expiration Requiring a periodic password change can reduce the time window that an adversary
has to crack a password, while also limiting the damage caused by password exposures at
other locations. Password expiration may be a good mitigating technique when long complex
passwords are not desired. See NIST 800-63B [REF-1053] for further information on password
requirements.
Phase: Architecture and Design
Consider a second authentication factor beyond the password, which prevents the password
from being a single point of failure. See CWE-308 for further information.
Phase: Implementation
Consider implementing a password complexity meter to inform users when a chosen password
meets the required attributes.
Observed Examples
Reference Description
CVE-2020-4574 key server application does not require strong passwords
CWE Version 4.14
CWE-522: Insufficiently Protected Credentials
CWE-522: Insufficiently Protected Credentials