CWE-309: Use of Password System for Primary Authentication
Use of Password System for Primary Authentication
Weakness ID: 309 (Weakness Base)
Status: Draft
Description
Description Summary
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism; Gain privileges / assume
identity
A password authentication mechanism error will almost always result in
attackers being authorized as valid users.
Likelihood of Exploit
Very High
Demonstrative Examples
Example 1
In both of these examples, a user is logged in if their given
password matches a stored password:
This code fails to incorporate more than one method of authentication. If an attacker can steal or guess a user's password, they are given full access to their account. Note this code also exhibits CWE-328 (Reversible One-Way Hash) and CWE-759 (Use of a One-Way Hash without a Salt).
Potential Mitigations
Phase: Architecture and Design
In order to protect password systems from compromise, the following
should be noted:
Passwords should be stored safely to prevent insider attack and to
ensure that -- if a system is compromised -- the passwords are not
retrievable. Due to password reuse, this information may be useful
in the compromise of other systems these users work with. In order
to protect these passwords, they should be stored encrypted, in a
non-reversible state, such that the original text password cannot be
extracted from the stored value.
Password aging should be strictly enforced to ensure that
passwords do not remain unchanged for long periods of time. The
longer a password remains in use, the higher the probability that it
has been compromised. For this reason, passwords should require
refreshing periodically, and users should be informed of the risk of
passwords which remain in use for too long.
Password strength should be enforced intelligently. Rather than
restrict passwords to specific content, or specific length, users
should be encouraged to use upper and lower case letters, numbers,
and symbols in their passwords. The system should also ensure that
no passwords are derived from dictionary words.
Phase: Architecture and Design
Use a zero-knowledge password protocol, such as SRP.
Phase: Architecture and Design
Ensure that passwords are stored safely and are not reversible.
Phase: Architecture and Design
Implement password aging functionality that requires passwords be
changed after a certain point.
Phase: Architecture and Design
Use a mechanism for determining the strength of a password and notify
the user of weak password use.
Phase: Architecture and Design
Inform the user of why password protections are in place, how they
work to protect data integrity, and why it is important to heed their
warnings.
Background Details
Password systems are the simplest and most ubiquitous authentication
mechanisms. However, they are subject to such well known attacks,and such
frequent compromise that their use in the most simple implementation is not
practical.
Description
