CWE-309: Use of Password System for Primary Authentication
Description
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Example - 1
In both of these examples, a user is logged in if their given password matches a stored password: This code relies exclusively on a password mechanism (CWE-309) using only one factor of authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also does not use a salt (CWE-759).
// //Login if hash matches stored hash//
login_user();ctext = simple_digest("sha1",plaintext,strlen(plaintext), ... );if (equal(ctext, secret_password())) {}unsigned char *check_passwd(char *plaintext) {}
// //Login if hash matches stored hash//
login_user();String plainText = new String(plainTextIn);MessageDigest encer = MessageDigest.getInstance("SHA");encer.update(plainTextIn);byte[] digest = password.digest();if (equal(digest,secret_password())) {}
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.