Skip to main content

Security controls bypass or absence - Facial Recognition

Description

By using the F015 finding to obtain a token, it is possible to bypass facial recognition processes to enter application transactions, and likewise to accept or deny authorizations from a user.

Impact

  • Log in to the allied portal as any user.
  • Approve or reject a users transactions.

Recommendation

Put in place for every resource with business-critical functionality a strong authentication process and ensure that every user attempting to access it is logged in.

Threat

Anonymous attacker from the Internet with a valid token.

Expected Remediation Time

⌚ 450 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: H
  • Integrity: H
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 7.4
    • Temporal: 7.4
  • Severity:
    • Base: High
    • Temporal: High

Code Examples

Compliant code

The secure facial recognition procedures should never be allowed to be bypassed

using namespace std;
using namespace cv;
// Function for Face Detection
void detectAndDraw( Mat& img, CascadeClassifier& cascade,
CascadeClassifier& nestedCascade, double scale );
string cascadeName, nestedCascadeName;

void getAccess(Scanner, imgFile){
nestedCascade.detectMultiScale( Scanner img);
if (isMatch(Scanner, imgFile)){
//Granting access through a secure process
}else{
//Deny access
}
}

Non compliant code

There are methods in the code that allow the facil recognition features to be bypassed in some scenarios

using namespace std;
using namespace cv;
// Function for Face Detection
void detectAndDraw( Mat& img, CascadeClassifier& cascade,
CascadeClassifier& nestedCascade, double scale );
string cascadeName, nestedCascadeName;

void getAccess(Scanner, imgFile, backUpToken){
nestedCascade.detectMultiScale( Scanner img);
if (isMatch(Scanner, imgFile)){
//Granting access through a secure process
}else if (backUpToken != null){
//granting access through secondary vulnerable process
}
}

Requirements