1718
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
}
Example 2:
The following code could be for a medical records application. It performs authentication by
checking if a cookie has been set.
Example Language: PHP (Bad)
$auth = $_COOKIES['authenticated'];
if (! $auth) {
if (AuthenticateUser($_POST['user'], $_POST['password']) == "success") {
// save the cookie to send out in future responses
setcookie("authenticated", "1", time()+60*60*2);
}
else {
ShowLoginScreen();
die("\n");
}
}
DisplayMedicalHistory($_POST['patient_ID']);
The programmer expects that the AuthenticateUser() check will always be applied, and the
"authenticated" cookie will only be set when authentication succeeds. The programmer even
diligently specifies a 2-hour expiration for the cookie.
However, the attacker can set the "authenticated" cookie to a non-zero value such as 1. As a
result, the $auth variable is 1, and the AuthenticateUser() check is not even performed. The
attacker has bypassed the authentication.
Example 3:
In the following example, an authentication flag is read from a browser cookie, thus allowing for
external control of user state data.
Example Language: Java (Bad)
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("authenticated") && Boolean.TRUE.equals(c.getValue())) {
authenticated = true;
}
}
Example 4:
The following code samples use a DNS lookup in order to decide whether or not an inbound
request is from a trusted host. If an attacker can poison the DNS cache, they can gain trusted
status.
Example Language: C (Bad)
struct hostent *hp;struct in_addr myaddr;
char* tHost = "trustme.example.com";
myaddr.s_addr=inet_addr(ip_addr_string);
hp = gethostbyaddr((char *) &myaddr, sizeof(struct in_addr), AF_INET);
if (hp && !strncmp(hp->h_name, tHost, sizeof(tHost))) {
trusted = true;
} else {
trusted = false;
CWE Version 4.14
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CWE-807: Reliance on Untrusted Inputs in a Security Decision