CWE-262: Not Using Password Aging

What is Not Using Password Aging?

• Overview: Not Using Password Aging (CWE-262) refers to the absence of a policy that mandates periodic password changes for users, which can potentially lead to security risks if passwords are not regularly updated.

• Exploitation Methods:

• Attackers can exploit this vulnerability by discovering and using outdated passwords that have not been changed.
• Common attack patterns include credential stuffing and brute force attacks using leaked password databases.

• Security Impact:

• Direct consequences include unauthorized access if old passwords are compromised.
• Potential cascading effects could involve data breaches and unauthorized access to sensitive information.
• Business impact may include financial losses, reputational damage, and non-compliance with regulatory requirements.

• Prevention Guidelines:

• Implement password aging policies to enforce regular password changes.
• Use security best practices like educating users on creating strong, unique passwords.
• Recommended tools and frameworks include those that support modern authentication methods such as multi-factor authentication (MFA) and password managers to help users manage complex passwords securely.

Corgea can automatically detect and fix Not Using Password Aging in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Low

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

import datetime

class User:
    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.password_last_changed = datetime.datetime.now()

    def is_password_expired(self):
        # Vulnerable code: Password expiration is not checked
        # Users can keep the same password indefinitely, posing security risks
        return False

In this code, the is_password_expired method always returns False, indicating that passwords never expire. This vulnerability can lead to security risks, as users might continue using the same password for an extended period, increasing the chance of password theft or misuse.

How to fix Not Using Password Aging?

To resolve this issue, implement a password aging mechanism by checking if the password has been used beyond a certain threshold (e.g., 90 days). If it has, the system should prompt the user to change their password. This helps mitigate the risk of compromised credentials by ensuring passwords are updated regularly.

Fixed Code Example

import datetime

class User:
    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.password_last_changed = datetime.datetime.now()

    def is_password_expired(self):
        # Fixed code: Implement password expiration check
        # A password is considered expired if it is older than 90 days
        expiration_threshold = datetime.timedelta(days=90)
        return datetime.datetime.now() - self.password_last_changed > expiration_threshold

    def change_password(self, new_password):
        # Method to change the user's password and reset the last changed date
        self.password = new_password
        self.password_last_changed = datetime.datetime.now()

In the fixed code, the is_password_expired method now calculates the difference between the current date and the password_last_changed date. If this difference exceeds the expiration_threshold (90 days), it returns True, indicating the password has expired and needs to be changed. This implementation encourages users to update their passwords regularly, enhancing security.