When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Extended Description
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism; Gain privileges / assume
identity
Demonstrative Examples
Example 1
This code changes a user's password.
(Bad Code)
Example
Language: PHP
$user = $_GET['user'];
$pass = $_GET['pass'];
$checkpass = $_GET['checkpass'];
if ($pass == $checkpass) {
SetUserPassword($user, $pass);
}
While the code confirms that the requesting user typed the same new
password twice, it does not confirm that the user requesting the
password change is the same user whose password will be changed. An
attacker can request a change of another user's password and gain
control of the victim's account.
Web app allows remote attackers to change the
passwords of arbitrary users without providing the original password, and
possibly perform other unauthorized actions.
Web application password change utility doesn't
check the original password.
Potential Mitigations
Phase: Architecture and Design
When prompting for a password change, force the user to provide the
original password in addition to the new password.
Phase: Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure
that you are only providing information to the actual user, e.g. by
using an email address or challenge question that the legitimate user
already provided in the past; do not allow the current user to change
this identity information until the correct password has been
provided.
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 19: Use of Weak Password-Based Systems." Page
279. McGraw-Hill. 2010.
Description
