Authentication / Use of Password Hash Instead of Password for Authentication

Description

Use of Password Hash Instead of Password for Authentication (CWE-299) is a vulnerability involving authentication procedures for web applications and APIs. This vulnerability occurs when credentials are stored in the form of a hash instead of a password, allowing attackers to access systems without knowing the original password. This vulnerability can be exploited through brute-force attacks and other malicious means. According to OWASP Testing Guide, it is important for organizations to ensure that passwords are stored in a secure manner and that authentication protocols are configured to use secure methods such as two-factor authentication (2FA).

Risk

The risk associated with this vulnerability is that attackers can gain unauthorized access to systems and data without knowing the original password. This can lead to data theft and manipulation, as well as disruption of services. Additionally, it can create a backdoor into the system, allowing attackers to gain access at any time. It is important to assess the risk associated with this vulnerability and take appropriate measures to protect the system.

Solution

The solution to this vulnerability is to ensure that passwords are stored in a secure manner and that authentication protocols are configured to use secure methods such as two-factor authentication (2FA). Additionally, it is recommended to use password hashing algorithms that are designed to be slow and computationally expensive, such as bcrypt, to make brute-force attacks more difficult.

Example

The following example from the CVE directory demonstrates how an attacker can exploit this vulnerability by using a brute-force attack to guess the password hash.

#!/usr/bin/perl

use strict;
use warnings;
use Digest::MD5 qw(md5 md5_hex md5_base64);

my $hash = $ARGV[0];

my @chars = ( 'A' .. 'Z', 'a' .. 'z', 0 .. 9 );

for ( my $i = 0; $i < length($hash); $i++ ) {
    foreach my $char (@chars) {
        my $try = substr( $hash, 0, $i ) . $char;
        if ( md5_hex($try) eq $hash ) {
            print "$try\n";
            exit 0;
        }
    }
}