CWE-223, Omission of Security-relevant Information, applies when the product does not record or display information that would be important for finding the source or nature of an attack, or for deciding whether an action is safe.
It affects authentication systems, mail and messaging software, and any application that produces an audit trail.
How it happens
The record is simply incomplete, often in the cases that matter most. MITRE's observed examples:
- CVE-1999-1029: login attempts are not recorded if the user disconnects before the maximum number of tries.
- CVE-2000-0542: failed authentication attempts are not recorded if a later attempt succeeds.
- CVE-2002-1839: the sender's IP address is not recorded in outgoing e-mail.
Both login cases are the worst ones to miss. A guessing attack that ends in success leaves no trail of the failures before it.
# Vulnerable: failures are only logged when the lockout threshold is hit
if not check_password(user, pw):
attempts[user] += 1
if attempts[user] >= MAX_TRIES:
log.warning("lockout user=%s", user)
What an attacker gains
MITRE lists non-repudiation: the attacker hides activities. The source of an attack becomes hard or impossible to find, and attacks go on unnoticed.
How to find it
MITRE lists no detection methods. Walk through each security-relevant event and check the log after performing it: failed login, successful login after failures, disconnect mid-attempt, permission change, outbound message. Ask whether the log would let you name the actor, the source address, the time and the outcome.
How to fix it
MITRE gives no mitigations for this entry. Practical steps:
- Record every authentication attempt, success or failure, at the moment it happens.
- Include source address, account, time and result in each record.
- Record events that end early, such as dropped connections.
- Keep secrets out of the log.
ok = check_password(user, pw)
log.info("auth user=%s ip=%s result=%s", user, ip, "ok" if ok else "fail")
Quick check
What should a login log entry contain at minimum?
Who tried, from where, when, and whether it worked. Never the password.
