#SecurityExplained S-100: CWE Top 25:
CWE-306: Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a verified user identification or uses a considerable number of resources.
1/n
CWE-306: Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a verified user identification or uses a considerable number of resources.
1/n
2/n
This vulnerability is frequently introduced during the architecture and design phase of the application development process.
This vulnerability is frequently introduced during the architecture and design phase of the application development process.
3/n
A critical vulnerability in the online interface of McAfee Advanced Threat Defense is a real-world example of such a problem (CVE-2017-4052).
A critical vulnerability in the online interface of McAfee Advanced Threat Defense is a real-world example of such a problem (CVE-2017-4052).
4/n
The flaw allows an unauthenticated, remote attacker to change configuration settings or obtain administrative access to the affected application by sending a specially crafted HTTP request.
The flaw allows an unauthenticated, remote attacker to change configuration settings or obtain administrative access to the affected application by sending a specially crafted HTTP request.
5/n
This language-independent issue, missing authentication for crucial functions, can occur in any multiuser environment.
This language-independent issue, missing authentication for crucial functions, can occur in any multiuser environment.
6/n
# Potential Impact:
• The impact of this vulnerability might range from information leakage to complete application compromise, depending on the disclosed functionality and application capabilities.
# Potential Impact:
• The impact of this vulnerability might range from information leakage to complete application compromise, depending on the disclosed functionality and application capabilities.
7/n
• An attacker has access to the functionality's privilege level by exposing crucial functionality. The consequences will vary depending on the functionality involved.
• An attacker has access to the functionality's privilege level by exposing crucial functionality. The consequences will vary depending on the functionality involved.
8/n
Still, they could include reading or altering sensitive data, gaining access to administrative or other privileged functions, or even executing arbitrary code.
Still, they could include reading or altering sensitive data, gaining access to administrative or other privileged functions, or even executing arbitrary code.
9/n
# Mitigation:
• Separate the software into four sections: anonymous, regular, privileged, and administrative. Determine which of these locations requires a verified user identity and implement a centralised authentication solution.
# Mitigation:
• Separate the software into four sections: anonymous, regular, privileged, and administrative. Determine which of these locations requires a verified user identity and implement a centralised authentication solution.
10/n
• Determine the application's user roles and access permissions.
• Avoid writing custom authentication routines whenever possible and instead rely on the authentication features given by the framework, operating system, or environment.
• Determine the application's user roles and access permissions.
• Avoid writing custom authentication routines whenever possible and instead rely on the authentication features given by the framework, operating system, or environment.
n/n
• Use a well-tested library or framework to prevent this flaw from arising or provide constructs that make it easy to avoid.
• Consider using libraries that support authentication, such as OpenSSL or the ESAPI Authenticator.
• Use a well-tested library or framework to prevent this flaw from arising or provide constructs that make it easy to avoid.
• Consider using libraries that support authentication, such as OpenSSL or the ESAPI Authenticator.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
