711
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Actions, which may not be authorized otherwise, can be
carried out as if they were validated by the server referred
to.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
In order to usefully check if a given action is authorized, some means of strong authentication
and method protection must be used. Use other means of authorization that cannot be simply
spoofed. Possibilities include a username/password or certificate.
Demonstrative Examples
Example 1:
The following code samples check a packet's referer in order to decide whether or not an inbound
request is from a trusted host.
Example Language: C++ (Bad)
String trustedReferer = "http://www.example.com/"
while(true){
n = read(newsock, buffer, BUFSIZE);
requestPacket = processPacket(buffer, n);
if (requestPacket.referer == trustedReferer){
openNewSecureSession(requestPacket);
}
}
Example Language: Java (Bad)
boolean processConnectionRequest(HttpServletRequest request){
String referer = request.getHeader("referer")
String trustedReferer = "http://www.example.com/"
if(referer.equals(trustedReferer)){
openPrivilegedConnection(request);
return true;
}
else{
sendPrivilegeError(request);
return false;
}
}
These examples check if a request is from a trusted referer before responding to a request, but
the code only verifies the referer name as stored in the request packet. An attacker can spoof the
referer, thus impersonating a trusted client.
CWE Version 4.14
CWE-294: Authentication Bypass by Capture-replay
CWE-294: Authentication Bypass by Capture-replay