Authentication mechanism absence or evasion - WiFi
Description
Te system has one old authentication mechanism that can be bypassed and be vulnerable to an intrusion. An attacker can gain access to the network and see communication traffic, whether encrypted or not.
Impact
Set a fragil encryption technique in authentication become a target for exploitation.
Recommendation
- Select the most secure authentication method that is supported by your wireless network clients.
- Set up strong encryption algorithms in order to enforce authentication protocol.
Threat
Unauthenticated internal attacker.
Expected Remediation Time
⌚ 120 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: U
- Confidentiality: L
- Integrity: L
- Availability: N
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:X/RL:X/RC:X
- Score:
- Base: 6.5
- Temporal: 6.5
- Severity:
- Base: Medium
- Temporal: Medium
Compliant code
A secure authentication method is provided
<authentication>
<anonymousAuthentication enabled="false" />
<basicAuthentication enabled="false" />
<clientCertificateMappingAuthentication enabled="false" />
<digestAuthentication enabled="false" />
<iisClientCertificateMappingAuthentication enabled="false">
</iisClientCertificateMappingAuthentication>
<windowsAuthentication enabled="true">
<providers>
<add value="Negotiate" />
<add value="NTLM" />
</providers>
</windowsAuthentication>
</authentication>
Non compliant code
The application uses an unsafe encryption method as authentication protocol
<authentication>
<anonymousAuthentication enabled="true" />
<basicAuthentication enabled="true" />
<clientCertificateMappingAuthentication enabled="false" />
<digestAuthentication enabled="false" />
<iisClientCertificateMappingAuthentication enabled="false">
</iisClientCertificateMappingAuthentication>
</authentication>
Requirements
- 227.Display access notification
- 228.Authenticate using standard protocols
- 229.Request access credentials
- 231.Implement a biometric verification component
- 235.Define credential interface
- 264.Request authentication
- 319.Make authentication options equally secure
Fixes
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.