Weak Authentication

Incomplete Class

Structure: Simple

Description

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Extended Description

Attackers may be able to bypass weak authentication faster and/or with less effort than expected.

Common Consequences 1

Scope: IntegrityConfidentialityAvailabilityAccess Control

Impact: Read Application DataGain Privileges or Assume IdentityExecute Unauthorized Code or Commands

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Demonstrative Examples 1

ID : DX-153

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

Multiple OT products used weak authentication.

Observed Examples 6

CVE-2022-30034Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (Regular Expression without Anchors), potentially allowing bypass of OAuth (Weak Authentication).

CVE-2022-35248Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication

CVE-2021-3116Chain: Python-based HTTP Proxy server uses the wrong boolean operators (Use of Incorrect Operator) causing an incorrect comparison (Incorrect Comparison) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (Weak Authentication)

CVE-2022-29965Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords

CVE-2022-29959Initialization file contains credentials that can be decoded using a "simple string transformation"

CVE-2020-8994UART interface for AI speaker uses empty password for root shell

References 1

OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management

Forescout Vedere Labs

20-06-2022

https://www.forescout.com/resources/ot-icefall-report/

ID: REF-1283

Applicable Platforms

Languages:

Not Language-Specific : Undetermined

Technologies:

ICS/OT : UndeterminedNot Technology-Specific : Undetermined

Modes of Introduction

Architecture and Design

Implementation

Related Weaknesses

ChildOf:

Improper Authentication (CWE-287)