Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-309:Use of Password System for Primary Authentication
Weakness ID:309
Version:v4.17
Weakness Name:Use of Password System for Primary Authentication
Vulnerability Mapping:Allowed
Abstraction:Base
Structure:Simple
Status:Draft
Likelihood of Exploit:High
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

▼Extended Description

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowed-with-ReviewC1390Weak Authentication
ChildOfAllowedB654Reliance on a Single Factor in a Security Decision
ParentOfAllowedB308Use of Single-factor Authentication
ParentOfAllowedB262Not Using Password Aging
Nature: ChildOf
Mapping: Allowed-with-Review
Type: Class
ID: 1390
Name: Weak Authentication
Nature: ChildOf
Mapping: Allowed
Type: Base
ID: 654
Name: Reliance on a Single Factor in a Security Decision
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 308
Name: Use of Single-factor Authentication
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 262
Name: Not Using Password Aging
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
MemberOfProhibitedC947SFP Secondary Cluster: Authentication Bypass
MemberOfProhibitedC1211Authentication Errors
MemberOfProhibitedC1396Comprehensive Categorization: Access Control
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 724
Name: OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 947
Name: SFP Secondary Cluster: Authentication Bypass
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1211
Name: Authentication Errors
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1396
Name: Comprehensive Categorization: Access Control
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-274High likelihood of exploit
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-316Bypass Protection Mechanism (impact)
MemberOfProhibitedBSBOSS-332Gain Privileges or Assume Identity (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-274
Name: High likelihood of exploit
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-316
Name: Bypass Protection Mechanism (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-332
Name: Gain Privileges or Assume Identity (impact)
▼Relevant To View
Relevant to the view"Software Development - (699)"
NatureMappingTypeIDName
MemberOfProhibitedC1211Authentication Errors
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1211
Name: Authentication Errors
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC947SFP Secondary Cluster: Authentication Bypass
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 947
Name: SFP Secondary Cluster: Authentication Bypass
▼Background Detail

Password systems are the simplest and most ubiquitous authentication mechanisms. However, they are subject to such well known attacks,and such frequent compromise that their use in the most simple implementation is not practical.

▼Common Consequences
ScopeLikelihoodImpactNote
Access ControlN/ABypass Protection MechanismGain Privileges or Assume Identity

A password authentication mechanism error will almost always result in attackers being authorized as valid users.

Scope: Access Control
Likelihood: N/A
Impact: Bypass Protection Mechanism, Gain Privileges or Assume Identity
Note:

A password authentication mechanism error will almost always result in attackers being authorized as valid users.

▼Potential Mitigations
Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

In order to protect password systems from compromise, the following should be noted:

  • Passwords should be stored safely to prevent insider attack and to ensure that -- if a system is compromised -- the passwords are not retrievable. Due to password reuse, this information may be useful in the compromise of other systems these users work with. In order to protect these passwords, they should be stored encrypted, in a non-reversible state, such that the original text password cannot be extracted from the stored value.
  • Password aging should be strictly enforced to ensure that passwords do not remain unchanged for long periods of time. The longer a password remains in use, the higher the probability that it has been compromised. For this reason, passwords should require refreshing periodically, and users should be informed of the risk of passwords which remain in use for too long.
  • Password strength should be enforced intelligently. Rather than restrict passwords to specific content, or specific length, users should be encouraged to use upper and lower case letters, numbers, and symbols in their passwords. The system should also ensure that no passwords are derived from dictionary words.
Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Use a zero-knowledge password protocol, such as SRP.

Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Ensure that passwords are stored safely and are not reversible.

Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Implement password aging functionality that requires passwords be changed after a certain point.

Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Use a mechanism for determining the strength of a password and notify the user of weak password use.

Note:

Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Inform the user of why password protections are in place, how they work to protect data integrity, and why it is important to heed their warnings.

Note:

▼Modes Of Introduction
Phase: Architecture and Design
Note:

N/A

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

In both of these examples, a user is logged in if their given password matches a stored password:

Language: ( code)
N/A

Language: C(Bad code)
unsigned char *check_passwd(char *plaintext) { ctext = simple_digest("sha1",plaintext,strlen(plaintext), ... ); //Login if hash matches stored hash* if (equal(ctext, secret_password())) { login_user(); } }

Language: Java(Bad code)
String plainText = new String(plainTextIn); MessageDigest encer = MessageDigest.getInstance("SHA"); encer.update(plainTextIn); byte[] digest = password.digest(); //Login if hash matches stored hash* if (equal(digest,secret_password())) { login_user(); }

Language: ( code)
N/A

This code relies exclusively on a password mechanism (CWE-309) using only one factor of authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also does not use a salt (CWE-759).

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      CLASPN/AN/AUsing password systems
      OWASP Top Ten 2004A3CWE More SpecificBroken Authentication and Session Management
      Taxonomy Name: CLASP
      Entry ID: N/A
      Fit: N/A
      Entry Name: Using password systems
      Taxonomy Name: OWASP Top Ten 2004
      Entry ID: A3
      Fit: CWE More Specific
      Entry Name: Broken Authentication and Session Management
      ▼Related Attack Patterns
      IDName
      CAPEC-16
      Dictionary-based Password Attack
      CAPEC-49
      Password Brute Forcing
      CAPEC-509
      Kerberoasting
      CAPEC-55
      Rainbow Table Password Cracking
      CAPEC-555
      Remote Services with Stolen Credentials
      CAPEC-560
      Use of Known Domain Credentials
      CAPEC-561
      Windows Admin Shares with Stolen Credentials
      CAPEC-565
      Password Spraying
      CAPEC-600
      Credential Stuffing
      CAPEC-652
      Use of Known Kerberos Credentials
      CAPEC-653
      Use of Known Operating System Credentials
      CAPEC-70
      Try Common or Default Usernames and Passwords
      ID: CAPEC-16
      Name: Dictionary-based Password Attack
      ID: CAPEC-49
      Name: Password Brute Forcing
      ID: CAPEC-509
      Name: Kerberoasting
      ID: CAPEC-55
      Name: Rainbow Table Password Cracking
      ID: CAPEC-555
      Name: Remote Services with Stolen Credentials
      ID: CAPEC-560
      Name: Use of Known Domain Credentials
      ID: CAPEC-561
      Name: Windows Admin Shares with Stolen Credentials
      ID: CAPEC-565
      Name: Password Spraying
      ID: CAPEC-600
      Name: Credential Stuffing
      ID: CAPEC-652
      Name: Use of Known Kerberos Credentials
      ID: CAPEC-653
      Name: Use of Known Operating System Credentials
      ID: CAPEC-70
      Name: Try Common or Default Usernames and Passwords
      ▼References
      Reference ID: REF-18
      Title: The CLASP Application Security Process
      Author: Secure Software, Inc.
      Section:
      Publication:
      Publisher:
      Edition:
      URL:https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
      URL Date:2024-11-17
      Day:N/A
      Month:N/A
      Year:2005
      Details not found