CWE-302 Authentication Bypass by Assumed-Immutable Data

CWE-302 happens when an authentication scheme relies on data elements that the developer assumes cannot change, but that an attacker can control or modify. Web apps are the usual home for it, though MITRE lists the weakness as not technology specific.

How it happens

The classic form is a cookie that carries the login state. After login, the app sets loggedin=true or role=admin, and later pages read that cookie as fact. The browser belongs to the user, so the user can edit it. Hidden form fields and URL parameters have the same flaw, and so do environment variables in setups where an outside party can set them.

# Vulnerable: trusts a client-side flag
if request.cookies.get("authenticated") == "true":
    show_account(request.cookies.get("user_id"))

MITRE's observed examples include CVE-2002-1730 and CVE-2002-1734, both authentication bypass by setting certain cookies to "true", along with CVE-2002-0367 (DebPloit) and CVE-2004-0261 (web auth).

What an attacker gains

The consequence listed is a bypass of the protection mechanism: access control that should have stopped the attacker does not.

How to find it

The record lists no detection methods. Test by hand: log in, open browser developer tools, and edit every cookie, hidden field and parameter your app sets. Change values, delete them, and replay requests. If anything unlocks, the app trusts data it should not.

How to fix it

MITRE's mitigation is to implement proper protection for data assumed to be immutable, such as environment variables and hidden form fields. In plain steps:

1. Keep authentication state on the server. Give the client only an unguessable session identifier.
2. If state must live on the client, sign it (and encrypt it if it is sensitive) and verify the signature on every request.
3. Re-check authorization on the server for each action instead of reading a flag.

Quick check

Sources

• MITRE CWE-302