#7
A07:2021
Identification and Authentication Failures
Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.
概要
Previously known as Broken Authentication. Slid down from #2, now includes CWEs more related to identification failures. This category is still an integral part of the Top 10.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Credential stuffing
Attackers use lists of stolen credentials from other breaches to attempt login across many sites.
検出シグナル:
High volume of failed logins across multiple accounts from distributed sources
Session hijacking
Session tokens are captured or predicted, allowing attackers to impersonate authenticated users.
検出シグナル:
Session tokens appearing in URLs, sessions used from unexpected locations
Brute force attacks
Automated attempts to guess passwords through systematic trial of many possibilities.
検出シグナル:
High volume of failed login attempts against single or multiple accounts
予防方法
- Implement multi-factor authentication where possible
- Do not ship or deploy with default credentials
- Implement weak password checks against common passwords
- Align password policies with modern guidelines
- Harden registration and credential recovery against enumeration
- Limit or delay failed login attempts with proper logging
- Use secure session management with high-entropy session IDs
Shoulder検出付きCWE (9)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
CWE-798
6 致命的
11 ルール
Use of Hard-coded Credentials
python, dockerfile, go, javascript, typescript, yaml
CWE-306
6 ルール
Missing Authentication for Critical Function
python, go, typescript
CWE-307
5 ルール
Improper Restriction of Excessive Authentication Attempts
go
CWE-295
4 ルール
Improper Certificate Validation
go, javascript, typescript, python
CWE-384
3 ルール
Session Fixation
javascript, typescript, go, python
CWE-640
3 ルール
Weak Password Recovery Mechanism for Forgotten Password
go, javascript, typescript, python
CWE-287
2 致命的
2 ルール
Improper Authentication
javascript, typescript, python
CWE-521
2 ルール
Weak Password Requirements
go, javascript, typescript
CWE-259
1 ルール
Use of Hard-coded Password
javascript, typescript
その他のマップされたCWE (13)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。