CWE-287: Improper Authentication

Description:
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, ICS/OT
Parent weaknesses: CWE-284, CWE-284

Consequences:
  - Integrity: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usa
  - Manual Static Analysis: This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and m
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Architecture and Design] Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Demonstrative examples:
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:
my $q = new CGI; 
                      if ($q->cookie('loggedin') ne "true") { 
                         if (! AuthenticateUser($q->param('username'), $q->param('password'))) {

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

Real-world examples:
  - CVE-2024-11680: File-sharing PHP product does not check if user is logged in during requests for PHP library files under an includes/ directory, allowing configuration changes, code execution, and other impacts.
  - CVE-2022-35248: Chat application skips validation when Central Authentication Service
			 (CAS) is enabled, effectively removing the second factor from
			 two-factor authentication
  - CVE-2022-36436: Python-based authentication proxy does not enforce password authentication during the initial handshake, allowing the client to bypass authentication by specifying a 'None' authentication type.
  - CVE-2022-30034: Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).
  - CVE-2022-29951: TCP-based protocol in Programmable Logic Controller (PLC) has no authentication.