Executar análise estática (SAST) na base de código à procura do padrão inseguro no fluxo de dados.
CWE-1391 Classe Incompleto
Use of Weak Credentials
This vulnerability occurs when a system relies on weak authentication credentials—like default passwords, hard-coded keys, or easily guessable values—that an attacker can deduce, reuse, or predict…
Definição
What is CWE-1391?
This vulnerability occurs when a system relies on weak authentication credentials—like default passwords, hard-coded keys, or easily guessable values—that an attacker can deduce, reuse, or predict without needing to perform a full brute-force attack.
Authentication systems are designed to force attackers into time-consuming brute-force attempts when credentials are unknown. However, when credentials are weak—whether they are static, widely reused, or generated in a predictable pattern—attackers can bypass this protection entirely, gaining unauthorized access with minimal effort.
Weak credentials typically fall into three categories: hard-coded (static and unchangeable), default (common across installations but changeable), or predictable (generated using a flawed or guessable method). Even if a unique credential is intended for each deployment, a predictable generation process can still make it vulnerable to efficient guessing attacks, undermining the entire authentication mechanism.
Impacto no mundo real
Real-world CVEs caused by CWE-1391
-
Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)
-
Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
-
Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
-
Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used in typical deployments
-
microcontroller board has default password, allowing admin access
-
data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables
-
UART interface for AI speaker uses empty password for root shell
-
password manager does not generate cryptographically strong passwords, allowing prediction of passwords using guessable details such as time of generation
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
Identificar um caminho de código que trata input não confiável sem validação.
- 2
Criar um payload que explora o comportamento inseguro — injeção, traversal, overflow ou abuso de lógica.
- 3
Entregar o payload através de um pedido normal e observar a reação da aplicação.
- 4
Iterar até que a resposta exponha dados, execute código do atacante ou escale privilégios.
Exemplo de código vulnerável
Vulnerable pseudo
A MITRE não publicou um exemplo de código para este CWE. O padrão abaixo é ilustrativo — consulte os Recursos para referências canónicas.
// Example pattern — see MITRE for the canonical references.
function handleRequest(input) {
// Untrusted input flows directly into the sensitive sink.
return executeUnsafe(input);
} Exemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-1391
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Sinais de deteção
How to detect CWE-1391
Executar testes dinâmicos de segurança de aplicações (DAST) contra o endpoint em execução.
Monitorizar os registos em tempo de execução para traços de exceção invulgares, input malformado ou tentativas de contornar a autorização.
Revisão de código: sinalizar qualquer novo código que trate input desta superfície sem usar os ajudantes validados do framework.
CWE-1391
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Perguntas frequentes O que é o CWE-1391?
Qual a gravidade do CWE-1391?
Que linguagens ou plataformas são afetadas pelo CWE-1391?
Como posso prevenir o CWE-1391?
Como é que o Plexicus deteta e corrige o CWE-1391?
Onde posso saber mais sobre o CWE-1391?
Frequently asked questions
O que é o CWE-1391?
This vulnerability occurs when a system relies on weak authentication credentials—like default passwords, hard-coded keys, or easily guessable values—that an attacker can deduce, reuse, or predict without needing to perform a full brute-force attack.
Qual a gravidade do CWE-1391?
A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.
Que linguagens ou plataformas são afetadas pelo CWE-1391?
MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, ICS/OT, Not Technology-Specific.
Como posso prevenir o CWE-1391?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
Como é que o Plexicus deteta e corrige o CWE-1391?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-1391 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-1391?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/1391.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-1391
CWE-1390 Pai
Weak Authentication
This vulnerability occurs when a system's login or identity verification process is too easy to bypass or fool. While it attempts to check…
CWE-262 Irmão
Not Using Password Aging
This vulnerability occurs when a system lacks password expiration policies, allowing users to keep the same password indefinitely.
CWE-263 Irmão
Password Aging with Long Expiration
The system enforces password changes, but the time allowed between changes is excessively long, weakening security.
CWE-289 Irmão
Authentication Bypass by Alternate Name
This vulnerability occurs when a system checks access based on a resource or user name, but fails to account for all the different names…
CWE-290 Irmão
Authentication Bypass by Spoofing
This weakness occurs when an application's authentication system can be tricked into accepting forged or manipulated credentials, allowing…
CWE-294 Irmão
Authentication Bypass by Capture-replay
This vulnerability occurs when an attacker can intercept and record legitimate authentication traffic, then replay it later to gain…
CWE-301 Irmão
Reflection Attack in an Authentication Protocol
A reflection attack is a flaw in mutual authentication protocols that allows an attacker to impersonate a legitimate user without knowing…
CWE-302 Irmão
Authentication Bypass by Assumed-Immutable Data
This vulnerability occurs when an authentication system incorrectly treats certain data as unchangeable, when in fact an attacker can…
CWE-303 Irmão
Incorrect Implementation of Authentication Algorithm
This weakness occurs when a developer implements a standard authentication algorithm, but makes critical mistakes in the code that cause…
Recursos
Further reading
- MITRE — CWE-1391 oficial https://cwe.mitre.org/data/definitions/1391.html
- Researchers Out Default Passwords Packaged With ICS/SCADA Wares https://www.darkreading.com/endpoint-security/researchers-out-default-passwords-packaged-with-ics-scada-wares
- ICS Alert (ICS-ALERT-13-164-01): Medical Devices Hard-Coded Passwords https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01
- OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management https://www.forescout.com/resources/ot-icefall-report/
- Randstorm: You Can't Patch a House of Cards https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/
Pronto para validar o que importa?
Pronto para validar o que importa.
O Plexicus é Proof-Driven AppSec: achados validados, compreensão contextual e remediação revisada — ancorada em evidência, escopada com você.