Authentication is one of the foundations of application security. It allows a system to verify that a user is who they claim to be before granting access to accounts, applications or sensitive information.
When authentication or session management controls are implemented incorrectly, attackers may be able to impersonate legitimate users, compromise accounts or gain unauthorised access to sensitive systems.
These weaknesses are commonly referred to as broken authentication vulnerabilities.
What is broken authentication?
Broken authentication occurs when weaknesses in an application’s authentication or session management mechanisms allow an attacker to compromise user identities or authenticated sessions.
For example, an application may be vulnerable if it:
permits weak or easily guessed passwords;
fails to protect against automated login attempts;
allows compromised credentials to be repeatedly tested;
uses insecure password recovery processes;
fails to invalidate sessions correctly;
exposes or inadequately protects session tokens; or
lacks appropriate multi-factor authentication (MFA).
An attacker does not necessarily need to discover a complex technical vulnerability. If users reuse passwords across different services, credentials exposed in an unrelated data breach could potentially be used to access another application.
This is why authentication security needs to address both technical vulnerabilities and the way credentials, identities and sessions are managed.
Common broken authentication attacks
Attackers can exploit authentication weaknesses in several ways.
Credential stuffing
Credential stuffing involves automatically testing combinations of usernames and passwords obtained from previous data breaches against other applications.
The attack relies heavily on password reuse. If somebody uses the same credentials across multiple services, credentials compromised on one service could potentially provide access to another.
Brute-force attacks
Rather than relying on previously compromised credentials, a brute-force attack attempts large numbers of possible passwords until the correct credentials are found.
Rate limiting, account protection mechanisms and multi-factor authentication can make these attacks considerably more difficult.
Password spraying
Password spraying is a variation of a brute-force attack in which an attacker tests a small number of commonly used passwords against many different accounts.
By spreading attempts across multiple accounts, attackers may be able to avoid protections designed to lock an account after repeated unsuccessful login attempts.
Session hijacking
Authentication security does not end when somebody successfully logs in.
Applications commonly use session identifiers or tokens to maintain an authenticated user’s session. If an attacker can steal, predict or otherwise compromise one of these tokens, they may be able to impersonate the legitimate user without knowing their password.
Secure session handling is therefore an important part of protecting authenticated applications.
Weak password recovery
Password reset and account recovery functionality can provide another route into an account.
Predictable reset tokens, inadequate identity verification or improperly implemented recovery processes may allow an attacker to bypass otherwise strong authentication controls.
Authentication bypass vulnerabilities
Application logic or implementation errors can sometimes allow attackers to access functionality without completing the intended authentication process.
Because these weaknesses can be specific to an individual application, automated vulnerability scanning alone may not identify every issue.
Professional web application penetration testing can assess authentication controls, logged-in functionality and other application components for vulnerabilities that could provide unauthorised access.
What are the risks of broken authentication?
A successful authentication attack can give a cybercriminal the same access as a legitimate user.
The impact therefore depends heavily on which account is compromised and what that account is permitted to do.
Potential consequences include:
unauthorised access to customer or employee accounts;
exposure of confidential or personal information;
financial fraud;
modification or deletion of data;
compromise of privileged or administrator accounts;
access to additional applications or internal systems; and
reputational and financial damage following a breach.
Compromising a privileged account can be particularly serious because an attacker may gain access to administrative functionality unavailable to ordinary users.
Where suspicious authentication activity has already resulted in account compromise or unauthorised access, effective incident management and response services can help organisations investigate, contain and recover from the incident.
Broken authentication vs broken access control
Authentication and access control are closely related, but they are not the same thing.
Authentication establishes who a user is.
Access control determines what an authenticated user is allowed to access or do.
For example, stealing another user’s password to access their account is an authentication problem. An authenticated ordinary user manipulating an identifier or request to access another customer’s records could indicate a broken access control vulnerability.
The latter is commonly associated with vulnerabilities such as Insecure Direct Object References (IDOR).
Keeping this distinction clear is important when identifying, testing and remediating application vulnerabilities.
How to identify broken authentication vulnerabilities
Authentication vulnerabilities can be difficult to identify because some weaknesses only become apparent when application behaviour is tested manually.
Security teams should consider several areas.
Monitor failed login attempts
Repeated authentication failures, unusual login locations and abnormal authentication patterns can indicate credential stuffing, brute-force attacks or attempts to compromise accounts.
Monitoring should be combined with appropriate alerting so suspicious activity can be investigated.
Test rate limiting and account protections
Applications should have controls designed to make automated authentication attacks more difficult.
These controls should themselves be tested to determine whether attackers can bypass them.
Review session management
Applications should securely generate, store, transmit and invalidate session identifiers.
Sessions should expire appropriately, particularly following logout, password changes and other security-sensitive events.
Review password and account recovery
Password reset mechanisms should be tested as carefully as the login page itself.
An attacker who can bypass authentication through a weak account recovery process does not need to defeat the primary login mechanism.
Test authentication manually
Automated vulnerability scanners are useful, but authentication weaknesses can involve application-specific logic that requires manual testing.
OmniCyber’s web application penetration testing services assess web applications using real-world attack techniques to identify weaknesses across both unauthenticated and authenticated areas.
How to prevent broken authentication
There is no single control that eliminates every authentication vulnerability. Effective protection generally involves several layers of security.
Organisations should:
implement multi-factor authentication where appropriate;
enforce suitable password controls;
securely store passwords using appropriate modern password-hashing techniques;
prevent or limit automated authentication attempts;
monitor suspicious authentication behaviour;
use secure account recovery processes;
protect session identifiers and authentication tokens;
invalidate sessions correctly following logout and security-sensitive events;
avoid exposing credentials or session information in URLs or logs;
apply least-privilege access controls; and
regularly test applications for authentication and session management weaknesses.
Authentication weaknesses should also form part of a wider vulnerability management programme, helping organisations identify, prioritise and remediate security weaknesses before attackers can exploit them.
Developers should treat authentication as a security-critical component throughout the software development lifecycle rather than attempting to address it only after an application has gone live.
Can penetration testing detect authentication vulnerabilities?
Penetration testing can help identify authentication weaknesses by examining an application from the perspective of a real attacker.
Depending on the agreed scope, testing can examine areas such as login mechanisms, session management, account recovery, access controls and authenticated functionality.
OmniCyber provides CREST-certified penetration testing services covering applications, networks and infrastructure.
For applications specifically, web application security testing allows testers to assess vulnerabilities within public-facing functionality as well as logged-in areas of an application.
Testing may also identify related application vulnerabilities. For example, you can learn more about another common application attack in our guide to SQL injection vulnerabilities and how to prevent them.
Identify authentication weaknesses before attackers do
Authentication vulnerabilities can provide attackers with direct access to accounts, sensitive information and business-critical functionality.
Regular security testing helps organisations understand whether their authentication, session management and application security controls perform as expected when subjected to realistic attack techniques.
Request a penetration testing quote from OmniCyber Security to discuss your application, testing requirements and scope with our security team.
