792
This code sends a command to a remote server, using an encrypted password and nonce to prove
the command is from a trusted party:
Example Language: C++ (Bad)
String command = new String("some command to execute");
MessageDigest nonce = MessageDigest.getInstance("SHA");
nonce.update(String.valueOf("bad nonce"));
byte[] nonce = nonce.digest();
MessageDigest password = MessageDigest.getInstance("SHA");
password.update(nonce + "secretPassword");
byte[] digest = password.digest();
sendCommand(digest, command)
Once again the nonce used is always the same. An attacker may be able to replay previous
legitimate commands or execute new arbitrary commands.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 959 SFP Secondary Cluster: Weak Cryptography 888 2398
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Reusing a nonce, key pair in encryption
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-324: Use of a Key Past its Expiration Date
Weakness ID : 324
Structure : Simple
Abstraction : Base
Description
The product uses a cryptographic key or password past its expiration date, which diminishes its
safety significantly by increasing the timing window for cracking attacks against that key.
Extended Description
While the expiration of keys does not necessarily ensure that they are compromised, it is a
significant concern that keys which remain in use for prolonged periods of time have a decreasing
probability of integrity. For this reason, it is important to replace keys within a period of time
proportional to their strength.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-324: Use of a Key Past its Expiration Date
CWE-324: Use of a Key Past its Expiration Date