|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CWE-759: Use of a One-Way Hash without a Salt
 DescriptionDescription Summary The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.
Extended Description This makes it easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables. Common Consequences
Demonstrative ExamplesExample 1 In this example, a new user provides a new username and password to create an account. The program hashes the new user's password then stores it in a database. (Bad Code) Example
Language: Python def storePassword(userName,Password): hasher = hashlib.new('md5')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False
otherwise
return updateUserLogin(userName,hashedPassword)
While it is good to avoid storing a cleartext password, the program does not provide a salt to the hashing function, thus increasing the chances of an attacker being able to reverse the hash and discover the original password if the database is compromised. Fixing this is as simple as providing a salt to the hashing function on initialization: (Good Code) Example
Language: Python def storePassword(userName,Password): hasher = hashlib.new('md5',b'SaltGoesHere')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False
otherwise
return updateUserLogin(userName,hashedPassword)
Note that regardless of the usage of a salt, the md5 hash is no longer considered secure, so this example still exhibits CWE-327. Observed Examples
Potential Mitigations
Background Details
Relationships
Related Attack Patterns References
Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
May 14, 2012
|
|
CWE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2012, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|