What is Improper Authentication (CWE-287)?

TL;DR: Improper Authentication (CWE-287) is a vulnerability that occurs when an actor claims to have a given identity without proper verification. To fix this, use an authentication framework or library such as the OWASP ESAPI Authentication feature and regularly update dependencies.

At-a-Glance Table

What is Improper Authentication?

Improper Authentication (CWE-287) is a type of vulnerability that occurs when an actor claims to have a given identity without proper verification. As defined by the MITRE Corporation under CWE-287, and classified by the OWASP Foundation under A07:2025 - Authentication Failures, this weakness can lead to the exposure of resources or functionality to unintended actors.

Quick Summary

Improper Authentication (CWE-287) is a critical vulnerability that occurs when an actor claims to have a given identity without proper verification. This can lead to the exposure of sensitive information and even execute arbitrary code. To prevent this, it’s essential to implement proper authentication mechanisms and regularly update dependencies.

Jump to: Quick Summary · Improper Authentication Overview · How Improper Authentication Works · Business Impact of Improper Authentication · Improper Authentication Attack Scenario · How to Detect Improper Authentication · How to Fix Improper Authentication · Framework-Specific Fixes for Improper Authentication · How to Ask AI to Check Your Code for Improper Authentication · Improper Authentication Best Practices Checklist · Improper Authentication FAQ · Vulnerabilities Related to Improper Authentication · References · Scan Your Own Site

Improper Authentication Overview

What: Improper Authentication (CWE-287) occurs when an actor claims to have a given identity without proper verification.

Why it matters: This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Where it occurs: This vulnerability can occur in any application that uses authentication mechanisms.

Who is affected: Any user who interacts with an application that uses authentication mechanisms can be affected by this vulnerability.

Who is NOT affected: Users who do not interact with applications that use authentication mechanisms are not affected by this vulnerability.

How Improper Authentication Works

Root Cause

Improper Authentication (CWE-287) occurs when an actor claims to have a given identity without proper verification. This can be due to various reasons, including:

• Inadequate authentication mechanisms
• Insufficient validation of user credentials
• Lack of secure password storage

Attack Flow

1. An attacker attempts to access a resource or functionality by claiming to have a valid identity.
2. The application verifies the attacker’s credentials without proper validation.
3. The attacker gains unauthorized access to sensitive information or executes arbitrary code.

Prerequisites to Exploit

• The attacker must have knowledge of the authentication mechanism used by the application.
• The attacker must be able to bypass the authentication mechanism or exploit a vulnerability in it.

Vulnerable Code

import requests

def authenticate(username, password):
    response = requests.post('https://example.com/login', data={'username': username, 'password': password})
    if response.status_code == 200:
        return True
    else:
        return False

This code snippet demonstrates a vulnerable authentication mechanism that can be exploited by an attacker.

Secure Code

import requests

def authenticate(username, password):
    # Validate user credentials using a secure method (e.g., hashing and salting)
    if validate_credentials(username, password):
        response = requests.post('https://example.com/login', data={'username': username, 'password': password})
        if response.status_code == 200:
            return True
        else:
            return False
    else:
        return False

def validate_credentials(username, password):
    # Hash and salt the password for secure storage
    hashed_password = hash_password(password)
    stored_hashed_password = get_stored_hashed_password(username)
    if hashed_password == stored_hashed_password:
        return True
    else:
        return False

This code snippet demonstrates a secure authentication mechanism that uses hashing and salting to store passwords securely.

Business Impact of Improper Authentication

Improper Authentication (CWE-287) can have significant business impacts, including:

• Confidentiality: Sensitive information may be exposed to unauthorized actors.
• Integrity: Data may be modified or deleted by unauthorized actors.
• Availability: Systems may become unavailable due to excessive traffic from attackers.

Improper Authentication Attack Scenario

1. An attacker attempts to access a resource or functionality by claiming to have a valid identity.
2. The application verifies the attacker’s credentials without proper validation.
3. The attacker gains unauthorized access to sensitive information or executes arbitrary code.

How to Detect Improper Authentication

Manual Testing

• Verify that user credentials are properly validated and stored securely.
• Test authentication mechanisms for vulnerabilities.

Automated Scanners (SAST/DAST)

• Use automated scanning tools to identify potential vulnerabilities in authentication mechanisms.

PenScan Detection

• PenScan’s scanner engines actively test for this issue, ensuring you catch vulnerabilities before an attacker does.

False Positive Guidance

• Be cautious of false positives when detecting CWE-287 Improper Authentication. Verify that the issue is not due to a legitimate user or configuration setting.

How to Fix Improper Authentication

• Implement proper authentication mechanisms.
• Use secure password storage.
• Regularly update dependencies to ensure you have the latest security patches.

Framework-Specific Fixes for Improper Authentication

Java

import java.security.MessageDigest;

public class Authenticator {
    public boolean authenticate(String username, String password) {
        // Hash and salt the password for secure storage
        String hashedPassword = hashPassword(password);
        String storedHashedPassword = getStoredHashedPassword(username);
        if (hashedPassword.equals(storedHashedPassword)) {
            return true;
        } else {
            return false;
        }
    }

    public String hashPassword(String password) {
        // Hash and salt the password using a secure algorithm
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] hashedBytes = md.digest(password.getBytes());
        return bytesToHex(hashedBytes);
    }

    private String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder();
        for (byte b : bytes) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) {
                hexString.append('0');
            }
            hexString.append(hex);
        }
        return hexString.toString();
    }
}

Node.js

const crypto = require('crypto');

function authenticate(username, password) {
    // Hash and salt the password for secure storage
    const hashedPassword = hashPassword(password);
    const storedHashedPassword = getStoredHashedPassword(username);
    if (hashedPassword === storedHashedPassword) {
        return true;
    } else {
        return false;
    }
}

function hashPassword(password) {
    // Hash and salt the password using a secure algorithm
    const hashedBytes = crypto.createHash('sha256').update(password).digest();
    return hashedBytes.toString('hex');
}

Python/Django

import hashlib

def authenticate(username, password):
    # Hash and salt the password for secure storage
    hashedPassword = hashPassword(password)
    storedHashedPassword = getStoredHashedPassword(username)
    if hashedPassword == storedHashedPassword:
        return True
    else:
        return False

def hashPassword(password):
    # Hash and salt the password using a secure algorithm
    hashedBytes = hashlib.sha256(password.encode()).digest()
    return hashedBytes.hex()

# Get stored hashed password from database
def getStoredHashedPassword(username):
    # Query database for stored hashed password
    return storedHashedPassword

PHP

function authenticate($username, $password) {
    // Hash and salt the password for secure storage
    $hashedPassword = hashPassword($password);
    $storedHashedPassword = getStoredHashedPassword($username);
    if ($hashedPassword === $storedHashedPassword) {
        return true;
    } else {
        return false;
    }
}

function hashPassword($password) {
    // Hash and salt the password using a secure algorithm
    $hashedBytes = hash('sha256', $password);
    return $hashedBytes;
}

How to Ask AI to Check Your Code for Improper Authentication

Review the following code block for potential CWE-287 Improper Authentication vulnerabilities and rewrite it using proper authentication mechanisms:

import requests

def authenticate(username, password):
    # Vulnerable code snippet
    response = requests.post('https://example.com/login', data={'username': username, 'password': password})
    if response.status_code == 200:
        return True
    else:
        return False

Improper Authentication Best Practices Checklist

✅ Implement proper authentication mechanisms.

✅ Use secure password storage.

✅ Regularly update dependencies to ensure you have the latest security patches.

✅ Validate user credentials using a secure method (e.g., hashing and salting).

✅ Hash and salt passwords for secure storage.

Improper Authentication FAQ

How do I prevent CWE-287 Improper Authentication?

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

What are the common consequences of CWE-287 Improper Authentication?

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

How do I detect CWE-287 Improper Authentication in my application?

Use a combination of manual testing and automated scanning tools to identify potential vulnerabilities.

What are some best practices for preventing CWE-287 Improper Authentication?

Implement proper authentication mechanisms, use secure password storage, and regularly update dependencies.

Can I prevent CWE-287 Improper Authentication by using a specific framework or library?

Yes, using an authentication framework or library such as the OWASP ESAPI Authentication feature can help prevent this vulnerability.

How do I fix CWE-287 Improper Authentication in my application?

Implement proper authentication mechanisms, use secure password storage, and regularly update dependencies.

What are some common mistakes that lead to CWE-287 Improper Authentication?

Failing to implement proper authentication mechanisms, using insecure password storage, and not regularly updating dependencies can all contribute to this vulnerability.

Vulnerabilities Related to Improper Authentication

References

• MITRE: CWE-287
• OWASP: A07:2025 - Authentication Failures
• CAPEC: CAPEC-114, CAPEC-115, CAPEC-151, CAPEC-194, CAPEC-22, CAPEC-57, CAPEC-593, CAPEC-633, CAPEC-650, CAPEC-94
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Authentication and other risks before an attacker does.