696
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that
the code does not check the username and password. The attacker could do this with an HTTP
request containing headers such as:
Example Language: (Attack)
GET /cgi-bin/vulnerable.cgi HTTP/1.1
Cookie: user=Administrator
Cookie: loggedin=true
[body of request]
By setting the loggedin cookie to "true", the attacker bypasses the entire authentication check. By
using the "Administrator" value in the user cookie, the attacker also gains privileges to administer
the software.
Example 2:
In January 2009, an attacker was able to gain administrator access to a Twitter server because the
server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of
Twitter's support team and was able to successfully guess the member's password using a brute
force attack by guessing a large number of common words. After gaining access as the member
of the support staff, the attacker used the administrator panel to gain access to 33 accounts that
belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared
to come from the compromised accounts.
Example 3:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors did not use any authentication or used client-side authentication for critical
functionality in their OT products.
Observed Examples
Reference Description
CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is
enabled, effectively removing the second factor from two-factor authentication
https://www.cve.org/CVERecord?id=CVE-2022-35248
CVE-2022-36436 Python-based authentication proxy does not enforce password authentication
during the initial handshake, allowing the client to bypass authentication by
specifying a 'None' authentication type.
https://www.cve.org/CVERecord?id=CVE-2022-36436
CVE-2022-30034 Chain: Web UI for a Python RPC framework does not use regex anchors to
validate user login emails (CWE-777), potentially allowing bypass of OAuth
(CWE-1390).
https://www.cve.org/CVERecord?id=CVE-2022-30034
CVE-2022-29951 TCP-based protocol in Programmable Logic Controller (PLC) has no
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-29951
CVE-2022-29952 Condition Monitor uses a protocol that does not require authentication.
https://www.cve.org/CVERecord?id=CVE-2022-29952
CVE-2022-30313 Safety Instrumented System uses proprietary TCP protocols with no
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-30313
CVE-2022-30317 Distributed Control System (DCS) uses a protocol that has no authentication.
CWE Version 4.14
CWE-287: Improper Authentication
CWE-287: Improper Authentication