Insecure authentication over HTTP (Digest Authentication)

Description

The target application was found to authenticate users using the Digest Authentication scheme over HTTP. Digest Authentication uses an insecure hashing algorithm (MD5) to hash the username and password and sends it in the Authentication header. Attackers who are in between the communication path (or on the same local network) of the client and server could use packet sniffers to modify the server's response parameters to downgrade the security of the digest access authentication mode. Additionally, the server stores the hashed credentials, usually in a file called .htpasswd. Tools are readily available to crack these passwords.

Remediation

If possible, switch to a more robust method to authenticate users such as OAuth 2.0, or storing usernames and passwords in a data store protected by the Argon2id algorithm. If Digest Authentication must be used, ensure credentials are only transmitted over secure channels such as HTTPS/TLS.

Details

ID	Aggregated	CWE	Type	Risk
287.2	false	287	Passive	Low

Links

• OWASP
• OAuth 2.0
• CWE-287
• RFC