Fortify fix for Often Misused Authentication

Question

When I scan using Fortify I have vulnerabilities like "Often Misused: Authentication" in the code below. Is there any fix for this issue? I have seen related posts but I was not able to get a solution. Using ESAPI, I have provided a regex for hostname and ipadress but it does not work.

addr.getHostAddress()
java.net.InetAddress.getByName(nameServiceHost);
java.net.InetAddress.getLocalHost().getCanonicalHostName()
localhost.getHostName()

Do you rely on DNS names for security with this code? If yes, don't. If not, ignore the warning. It's not detecting a vulnerability, it detects that your code can has this vulnerability. https://www.owasp.org/index.php/Often_Misused:_Authentication has an example what not to do with those methods. — zapl, May 26 '16 at 11:51
@veera in my case also same issue if you have solution can share it — Laxminarayana Challagonda, Feb 09 '17 at 14:56
@LaxminarayanaChallagonda For my case i have written separate code for getting host name from command prompt — veera, Feb 14 '17 at 06:43
@veera can you share the solution if you have. are you using the Rumtime class and passing the cmd ? if this is the case we will get the Command Injection fortify issue ?? — Laxminarayana Challagonda, Feb 14 '17 at 13:57

score 2 · Answer 1 · edited Oct 07 '21 at 11:02

All other answers try to provide workarounds by not using the inbuilt API, but using the command line or something else. However, they miss the actual problem, it is not the API that is problematic here, it is the assumption that DNS can be used for authentication.

Attackers can spoof, that is falsify, DNS responses pretending to be a valid caller. They can also use IP address spoofing to appear to be a valid caller without attacking DNS.

TL;DR don't use DNS or caller-IP as an authentication source. Instead use SSL/TLS with for an encrypted connection, then you can use Basic-Authentication, Oauth2 or even better client-certificates aka mTLS instead.

score 0 · Answer 2 · answered May 18 '18 at 21:56

0

Try the InetSocketAddress wrapper, esp., for Elasticsearch Transport Client:

new InetSocketAddress(hostname, port)

answered May 18 '18 at 21:56

gansvv

21
1
3

Bhavisankar · Answer 3 · 2016-10-31T06:55:56.710

-1

You can verify whether the request is from a trusted host

String ip = request.getRemoteAddr(); 
InetAddress addr = InetAddress.getByName(ip); 
if (addr.getCanonicalHostName().endsWith("trustme.com")) { 
 trusted = true; 
}

edited Oct 31 '16 at 06:55

answered Oct 31 '16 at 06:50

Bhavisankar

43
1
9

Still issue exists – Laxminarayana Challagonda Mar 14 '17 at 13:18
The issue will "exist"; Fortify does not recognize the valid testing solution afterwards as valid - you need to False Positive the entry. – JoshDM Nov 17 '19 at 02:56
This do not solve the issue: https://vulncat.fortify.com/en/detail?id=desc.semantic.cpp.often_misused_authentication.getlogin#C%23%2FVB.NET%2FASP.NET – elpezganzo Aug 01 '22 at 01:07

score -2 · Answer 4 · answered Feb 14 '17 at 06:45

For my case i have re written the code like this

    public static String getIPAddress(String hostname) {
    Process process;
    String ipAddress = null;
    String localIpAddress = null;
    String[] commandArray;

    if(System.getProperty("os.name").startsWith("Windows")) {
        commandArray = new String[] {"cmd", "/c", "ping "+hostname+ " -4 | findstr Pinging"}; // For Windows
    } else {
        commandArray = new String[] { "bash", "-c", "host "+hostname}; // For Linux and OSX
    }

    try {
        process = Runtime.getRuntime().exec(commandArray);
        BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
        String[] output;
         // Reading the output of a command executed.
         while ((localIpAddress = stdInput.readLine()) != null) {
             if(System.getProperty("os.name").startsWith("Windows")) {
                 output = localIpAddress.split(" ");
                 ipAddress = output[2].replace("[", "").replace("]", "").trim();
             } else {                
                 output = localIpAddress.split("has address"); 
                 ipAddress = output[1];
             }
         }
    } catch (IOException e) {
        org.owasp.esapi.reference.Log4JLogFactory.getInstance().getLogger(" com.util.esapi.InetAddressWrapper.getIPAddress() << "+e+" >>");
    }
    return ipAddress;
}

process = Runtime.getRuntime().exec(commandArray); this line will give you the command injection? if i am not wrong — Laxminarayana Challagonda, Feb 15 '17 at 10:59
As mentioned above by Leonard. problem is the possibility of DNS spoofing. Getting the address using command line wont solve it. — Vishnu Dahatonde, Sep 03 '21 at 07:21

Fortify fix for Often Misused Authentication

4 Answers4

Linked