CWE-295: Improper Certificate Validation
Weakness ID: 295
Description
The software does not validate, or incorrectly validates, a certificate.
Extended Description
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Common Consequences
Technical Impact: Bypass Protection Mechanism
Potential Mitigations
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.::
Detection Methods
According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness: SOAR Partial
According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner
Effectiveness: SOAR Partial
According to SOAR, the following detection techniques may be useful: Highly cost effective: Man-in-the-middle attack tool
Effectiveness: High
According to SOAR, the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)
Effectiveness: High
According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
According to SOAR, the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness: High::