CWE-322: Key Exchange without Entity Authentication
The product performs a key exchange with an actor without verifying the identity of that actor.
How it's found
Key Exchange without Entity Authentication is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable an attacker to impersonate an actor by modifying traffic between the two entities. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.
Consequences
- Bypass Protection Mechanism: No authentication takes place in this process, bypassing an assumed protection of encryption.
- Read Application Data: The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.
Mitigations
- Architecture and Design: Ensure that proper authentication is included in the system design.
- Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-322?
The product performs a key exchange with an actor without verifying the identity of that actor.
How do you find Key Exchange without Entity Authentication?
Key Exchange without Entity Authentication is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-322?
Bypass Protection Mechanism: No authentication takes place in this process, bypassing an assumed protection of encryption. Read Application Data: The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.
Does TurboPentest test for Key Exchange without Entity Authentication?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest