1532
else {
ExitError("Authentication failed");
}
}
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass
parameter in order to determine how many characters to check in the password. So, if the attacker
only provides a password of length 1, the check will only examine the first byte of the application's
password before determining success.
As a result, this partial comparison leads to improper authentication (CWE-287).
Any of these passwords would still cause authentication to succeed for the "admin" user:
Example Language: (Attack)
p
pa
pas
pass
This significantly reduces the search space for an attacker, making brute force attacks more
feasible.
The same problem also applies to the username, so values such as "a" and "adm" will succeed for
the username.
While this demonstrative example may not seem realistic, see the Observed Examples for CVE
entries that effectively reflect this same weakness.
Observed Examples
Reference Description
CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators
(CWE-480) causing an incorrect comparison (CWE-697) that identifies an
authN failure if all three conditions are met instead of only one, allowing
bypass of the proxy authentication (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2021-3116
CVE-2020-15811 Chain: Proxy uses a substring search instead of parsing the Transfer-Encoding
header (CWE-697), allowing request splitting (CWE-113) and cache poisoning
https://www.cve.org/CVERecord?id=CVE-2020-15811
CVE-2016-10003 Proxy performs incorrect comparison of request headers, leading to infoleak
https://www.cve.org/CVERecord?id=CVE-2016-10003
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1140 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 06. Methods (MET)
1133 2447
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
CWE Version 4.14
CWE-698: Execution After Redirect (EAR)
CWE-698: Execution After Redirect (EAR)