CWE-620 未经验证的口令修改

Unverified Password Change

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

扩展描述

This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Access Control ['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity']

可能的缓解方案

Architecture and Design

策略:

When prompting for a password change, force the user to provide the original password in addition to the new password.

Architecture and Design

策略:

Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.

示例代码

例

This code changes a user's password.

bad PHP

$user = $_GET['user'];
$pass = $_GET['pass'];
$checkpass = $_GET['checkpass'];
if ($pass == $checkpass) {
SetUserPassword($user, $pass);
}

While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.

分析过的案例

标识 说明 链接
CVE-2007-0681 Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0681
CVE-2000-0944 Web application password change utility doesn't check the original password. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0944

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session Management
Software Fault Patterns SFP31 Missing authentication

引用