CWE-302: Authentication Bypass by Assumed-Immutable Data
Authentication Bypass by Assumed-Immutable Data
Weakness ID: 302 (Weakness Variant)
Status: Incomplete
Description
Description Summary
The authentication scheme or implementation uses key data
elements that are assumed to be immutable, but can be controlled or modified by
the attacker.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Demonstrative Examples
Example 1
In the following example, an "authenticated" cookie is used to
determine whether or not a user should be granted access to a system. Of
course, modifying the value of a cookie on the client-side is trivial, but
many developers assume that cookies are essentially immutable.
(Bad Code)
Java
boolean authenticated = new
Boolean(getCookieValue("authenticated")).booleanValue();
Description
