CWE-654: Reliance on a Single Factor in a Security Decision
Also known as: Separation of Privilege
A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
Last updated
Overview
CWE-654 (Reliance on a Single Factor in a Security Decision) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Common consequences
What can happen when CWE-654 is exploited.
Gain Privileges or Assume Identity
Affects: Access Control
If the single factor is compromised (e.g. by theft or spoofing), then the integrity of the entire security mechanism can be violated with respect to the user that is identified by that factor.
Hide Activities
Affects: Non-Repudiation
It can become difficult or impossible for the product to be able to distinguish between legitimate activities by the entity who provided the factor, versus illegitimate activities by an attacker.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-654, grouped by where in the lifecycle they apply.
Use multiple simultaneous checks before granting access to critical operations or granting critical privileges. A weaker but helpful mitigation is to use several successive checks (multiple layers of security).
Use redundant access rules on different choke points (e.g., firewalls).
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
Password-only authentication is perhaps the most well-known example of use of a single factor. Anybody who knows a user's password can impersonate that user.
When authenticating, use multiple factors, such as "something you know" (such as a password) and "something you have" (such as a hardware-based one-time password generator, or a biometric device).
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2022-35248 — Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication
Terminology & mappings
Alternate terms
- Separation of Privilege
- Some people and publications use the term "Separation of Privilege" to describe this weakness, but this term has dual meanings in current usage. While this entry is closely associated with the original definition of "Separation of Privilege" by Saltzer and Schroeder, others use the same term to describe poor compartmentalization (CWE-653). Because there are multiple interpretations, use of the "Separation of Privilege" term is discouraged.
Mapped taxonomies
- ISA/IEC 62443: Req SD-3 (Part 4-1)
- ISA/IEC 62443: Req SD-4 (Part 4-1)
- ISA/IEC 62443: Req SI-1 (Part 4-1)
Attack patterns
CAPEC attack patterns that exploit this weakness.
- CAPEC-16: Dictionary-based Password Attack
- CAPEC-274: HTTP Verb Tampering
- CAPEC-49: Password Brute Forcing
- CAPEC-55: Rainbow Table Password Cracking
- CAPEC-560: Use of Known Domain Credentials
- CAPEC-565: Password Spraying
- CAPEC-600: Credential Stuffing
- CAPEC-652: Use of Known Kerberos Credentials
- CAPEC-653: Use of Known Operating System Credentials
- CAPEC-70: Try Common or Default Usernames and Passwords
Frequently asked questions
Common questions about CWE-654.
- What is CWE-654?
- A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
- How do you prevent CWE-654?
- Use multiple simultaneous checks before granting access to critical operations or granting critical privileges. A weaker but helpful mitigation is to use several successive checks (multiple layers of security).
- What are the consequences of CWE-654?
- Exploiting CWE-654 can lead to: Gain Privileges or Assume Identity, Hide Activities.
References
- MITRE CWE definition (CWE-654) (opens in a new tab)
- CWE-654 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-654
Get alerted the moment a new CWE-654 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.