Book a Security Review

Weakness · High

CWE-287: Improper Authentication

What it is

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Likelihood of exploit: High47 exploited in the wildMITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
High
Introduced during
Architecture and Design, Implementation
Exploited in the wild
47 known exploited CVEs

What an attacker can do

  • Read Application Data (Integrity, Confidentiality, Availability, Access Control)
  • Gain Privileges or Assume Identity (Integrity, Confidentiality, Availability, Access Control)
  • Execute Unauthorized Code or Commands (Integrity, Confidentiality, Availability, Access Control)

How to prevent it

Architecture and Design

  • Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

How to find it

  • Automated Static Analysis. Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries. Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.
  • Manual Static Analysis. This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.
  • Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
  • Dynamic Analysis with Automated Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners
  • Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer
  • Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Manual Source Code Review (not inspections)
  • Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
  • Automated Static Analysis. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker
  • Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction

CWE-287 on MITRE's CWE site

Exploited in the wild: 47 CVEs

Vulnerabilities caused by CWE-287 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.

All known exploited vulnerabilities

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.