CWE-309 points at a design choice: using a password system as the primary means of authentication. MITRE says this can be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
This is a design-level entry, so it matters most to architects and teams choosing how users will log in.
How it happens
A password system has several places to go wrong at once: how passwords are chosen, how they are stored, how long they live and how they are transmitted. A weakness in any of them can undermine the rest. MITRE's note on consequences is blunt: a password authentication mechanism error will almost always result in attackers being authorized as valid users. The impact listed is bypass of a protection mechanism and gaining the identity of a user.
There are no observed CVE examples attached to this entry.
How to find it
MITRE lists no detection methods. Review the design:
- Where and how are passwords stored?
- Is there any way to retrieve a password in plain form?
- Do passwords expire?
- Does the system tell users when a password is weak?
- Is there an alternative or additional factor?
How to fix it
MITRE's mitigations for the architecture phase, in plain steps:
- Store passwords so they cannot be recovered. Store them in a non-reversible form, so that even if the system is compromised the originals cannot be extracted. This matters because users reuse passwords, which spreads damage to other systems.
- Enforce password aging. The longer a password stays in use, the more likely it has been compromised. Require periodic refreshes and warn users about old ones.
- Judge strength intelligently. Encourage upper and lower case letters, numbers and symbols, and make sure passwords are not derived from dictionary words. MITRE prefers this to rigid rules on content or length.
- Consider a zero-knowledge password protocol such as SRP.
- Measure strength and notify users when they pick a weak password.
- Tell users why. Explain why the protections exist and why warnings matter.
Combine this with a second factor, covered in CWE-308, so a password leak is not the end of the story.
Quick check
Why must stored passwords be non-reversible?
Because if the store leaks, reversible values hand attackers the original passwords, which users probably reuse elsewhere.
