CWE-301: Reflection Attack in an Authentication Protocol

Extended Description

A mutual authentication protocol requires each party to respond to a random challenge by the other party by encrypting it with a pre-shared key. Often, however, such protocols employ the same pre-shared key for communication with a number of different entities. A malicious user or an attacker can easily compromise this protocol without possessing the correct key by employing a reflection attack on the protocol. Reflection attacks capitalize on mutual authentication schemes in order to trick the target into revealing the secret shared between it and another valid user. In a basic mutual-authentication scheme, a secret is known to both the valid user and the server; this allows them to authenticate. In order that they may verify this shared secret without sending it plainly over the wire, they utilize a Diffie-Hellman-style scheme in which they each pick a value, then request the hash of that value as keyed by the shared secret. In a reflection attack, the attacker claims to be a valid user and requests the hash of a random value from the server. When the server returns this value and requests its own value to be hashed, the attacker opens another connection to the server. This time, the hash requested by the attacker is the value which the server requested in the first connection. When the server returns this hashed value, it is used in the first connection, authenticating the attacker successfully as the impersonated valid user.

Code Examples & CVEs

Demonstrative Examples

The following example demonstrates the weakness.

BadC

unsigned char *simple_digest(char *alg,char *buf,unsigned int len, int *olen) {const EVP_MD *m;EVP_MD_CTX ctx;unsigned char *ret;OpenSSL_add_all_digests();if (!(m = EVP_get_digestbyname(alg))) return NULL;if (!(ret = (unsigned char*)malloc(EVP_MAX_MD_SIZE))) return NULL;EVP_DigestInit(&ctx, m);EVP_DigestUpdate(&ctx,buf,len);EVP_DigestFinal(&ctx,ret,olen);return ret;}unsigned char *generate_password_and_cmd(char *password_and_cmd) {simple_digest("sha1",password,strlen(password_and_cmd)...);}

The following example demonstrates the weakness.

BadJava

String command = new String("some cmd to execute & the password") MessageDigest encer = MessageDigest.getInstance("SHA");encer.update(command.getBytes("UTF-8"));byte[] digest = encer.digest();

Observed CVE Examples (2)

CVE-2024-11022

web server includes the nonce in its challenge/response mechanism, allowing a replay attack

View Details

CVE-2005-3435

product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-301 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-301, Reflection Attack in an Authentication Protocol, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Reflection Attack in an Authentication Protocol during Architecture and Design

MITRE associates mitigation with Architecture and Design; recorded impacts include Gain Privileges or Assume Identity; the entry maps to CAPEC-90. Use these source-defined anchors to turn CWE-301 into implementation, review, and verification checks for the affected component.

CWE-301: Reflection Attack in an Authentication Protocol — MITRE CWE

Triage CWE-301 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-301, Reflection Attack in an Authentication Protocol, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-301

Apply MITRE's full root-cause mapping guidance when using CWE-301, Reflection Attack in an Authentication Protocol. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-301 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-301, Reflection Attack in an Authentication Protocol. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-301: Reflection Attack in an Authentication Protocol?+

CWE-301: Reflection Attack in an Authentication Protocol is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user. A mutual authentication protocol requires each party to respond to a random challenge by the other party by encrypting it with a pre-shared key. Often, however, such protocols employ the same pre-shared key for communication with a number of different entities. A malicious user or an attacker can easily compromise this protocol without possessing the correct key by employing a reflection attack on the protocol. Reflection attacks capitalize on mutual authentication schemes in order to trick the target into revealing the secret shared between it and another valid user. In a basic mutual-authentication scheme, a secret is known to both the valid user and the server; this allows them to authenticate. In order that they may verify this shared secret without sending it plainly over the wire, they utilize a Diffie-Hellman-style scheme in which they each pick a value, then request the hash of that value as keyed by the shared secret. In a reflection attack, the attacker claims to be a valid user and requests the hash of a random value from the server. When the server returns this value and requests its own value to be hashed, the attacker opens another connection to the server. This time, the hash requested by the attacker is the value which the server requested in the first connection. When the server returns this hashed value, it is used in the first connection, authenticating the attacker successfully as the impersonated valid user.

What are the security consequences of Reflection Attack in an Authentication Protocol?+

If exploited, CWE-301 (Reflection Attack in an Authentication Protocol) it can compromise Access Control, leading to outcomes such as Gain Privileges or Assume Identity.

How do you prevent or mitigate Reflection Attack in an Authentication Protocol?+

Recommended mitigations for CWE-301 include: Use different keys for the initiator and responder or of a different type of challenge for the initiator and responder. Let the initiator prove its identity before proceeding.

Which programming languages are affected by Reflection Attack in an Authentication Protocol?+

CWE-301 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Reflection Attack in an Authentication Protocol?+

MITRE documents real CVEs mapped to CWE-301, including CVE-2024-11022 and CVE-2005-3435. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-301 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-301: Reflection Attack in an Authentication Protocol

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description