CWE-288: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel
Weakness ID: 288 (Weakness Base)
Status: Incomplete
Description
Description Summary
A product requires authentication, but the product has an
alternate path or channel that does not require authentication.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Modes of Introduction
This is often seen in web applications that assume that access to a
particular CGI program can only be obtained through a "front" screen, when
the supporting programs are directly accessible. But this problem is not
just in web apps.
User can avoid lockouts by using an API instead of
the GUI to conduct brute force password
guessing.
Potential Mitigations
Phase
Description
Funnel all access through a single choke point to simplify how users
can access a resource. For every access, perform a check to determine if
the user has permissions to access the resource.
Description
