#7
A07:2025
Authentication Failures
Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.
概述
Renamed from 'Identification and Authentication Failures' for precision. This category covers weaknesses in authentication mechanisms including credential management, session handling, and identity verification.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Credential stuffing
Attackers use lists of stolen credentials from other breaches to attempt login across many sites.
检测信号:
High volume of failed logins across multiple accounts from distributed sources
Session hijacking
Session tokens are captured or predicted, allowing attackers to impersonate authenticated users.
检测信号:
Session tokens appearing in URLs, sessions used from unexpected locations
Brute force attacks
Automated attempts to guess passwords through systematic trial of many possibilities.
检测信号:
High volume of failed login attempts against single or multiple accounts
如何预防
- Implement multi-factor authentication where possible
- Do not ship or deploy with default credentials
- Implement weak password checks against common passwords
- Align password policies with modern guidelines (NIST 800-63)
- Harden registration and credential recovery against enumeration
- Limit or delay failed login attempts with proper logging
- Use secure session management with high-entropy session IDs
有Shoulder检测的CWE (8)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
CWE-306
6 规则
Missing Authentication for Critical Function
python, go, typescript
CWE-307
5 规则
Improper Restriction of Excessive Authentication Attempts
go
CWE-295
4 规则
Improper Certificate Validation
go, javascript, typescript, python
CWE-384
3 规则
Session Fixation
javascript, typescript, go, python
CWE-640
3 规则
Weak Password Recovery Mechanism for Forgotten Password
go, javascript, typescript, python
CWE-287
2 严重
2 规则
Improper Authentication
javascript, typescript, python
CWE-521
2 规则
Weak Password Requirements
go, javascript, typescript
CWE-259
1 规则
Use of Hard-coded Password
javascript, typescript
其他映射的CWE (13)
这些CWE映射到此类别，但尚无Shoulder规则。