Szczegóły CWE-295

CWE-295

Improper Certificate Validation
Draft
2006-07-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Powiadomienia dla konkretnego CWE
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CWE.
Zarządzaj powiadomieniami

Nazwa: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Informacje ogólne

Szczegóły kontekstowe

Sposoby wprowadzenia

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Implementation : When the product uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete.

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Technologie

Class: Not Technology-Specific (Undetermined)
Class: Web Based (Undetermined)
Class: Mobile (Undetermined)

Typowe konsekwencje

Zakres Wpływ Prawdopodobieństwo
Integrity
Authentication		Bypass Protection Mechanism, Gain Privileges or Assume Identity

Note: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.

Zaobserwowane przykłady

Odniesienia Opis

CVE-2019-12496

A Go framework for robotics, drones, and IoT devices skips verification of root CA certificates by default.

CVE-2014-1266

Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

CVE-2021-22909

Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494).

CVE-2008-4989

Verification function trusts certificate chains in which the last certificate is self-signed.

CVE-2012-5821

Web browser uses a TLS-related function incorrectly, preventing it from verifying that a server's certificate is signed by a trusted certification authority (CA)

CVE-2009-3046

Web browser does not check if any intermediate certificates are revoked.

CVE-2011-0199

Operating system does not check Certificate Revocation List (CRL) in some cases, allowing spoofing using a revoked certificate.

CVE-2012-5810

Mobile banking application does not verify hostname, leading to financial loss.

CVE-2012-3446

Cloud-support library written in Python uses incorrect regular expression when matching hostname.

CVE-2009-2408

Web browser does not correctly handle '\0' character (NUL) in Common Name, allowing spoofing of https sites.

CVE-2012-2993

Smartphone device does not verify hostname, allowing spoofing of mail services.

CVE-2012-5822

Application uses third-party library that does not validate hostname.

CVE-2012-5819

Cloud storage management application does not validate hostname.

CVE-2012-5817

Java library uses JSSE SSLSocket and SSLEngine classes, which do not verify the hostname.

CVE-2010-1378

chain: incorrect calculation allows attackers to bypass certificate checks.

CVE-2005-3170

LDAP client accepts certificates even if they are not from a trusted CA.

CVE-2009-0265

chain: DNS server does not correctly check return value from the OpenSSL EVP_VerifyFinal function allows bypass of validation of the certificate chain.

CVE-2003-1229

chain: product checks if client is trusted when it intended to check if the server is trusted, allowing validation of signed code.

CVE-2002-0862

Cryptographic API, as used in web browsers, mail clients, and other software, does not properly validate Basic Constraints.

CVE-2009-1358

chain: OS package manager does not check properly check the return value, allowing bypass using a revoked certificate.

Potencjalne środki zaradcze

Phases : Architecture and Design // Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Phases : Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

Metody wykrywania

Automated Static Analysis - Binary or Bytecode

Skuteczność : SOAR Partial

Manual Static Analysis - Binary or Bytecode

Skuteczność : SOAR Partial

Dynamic Analysis with Automated Results Interpretation

Skuteczność : SOAR Partial

Dynamic Analysis with Manual Results Interpretation

Skuteczność : High

Manual Static Analysis - Source Code

Skuteczność : High

Automated Static Analysis - Source Code

Skuteczność : SOAR Partial

Architecture or Design Review

Skuteczność : High

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Powiązane wzorce ataków

CAPEC-ID Nazwa wzorca ataku
CAPEC-459 Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475 Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

Odniesienia

REF-243

Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security
Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith, Lars Baumgärtner, Bernd Freisleben.
http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf

REF-244

Computer Security: Art and Science
M. Bishop.

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

Zgłoszenie

Nazwa Organizacja Data Data wydania Version
CWE Community 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

Modyfikacje

Nazwa Organizacja Data Komentarz
Veracode 2008-08-15 +00:00 Suggested OWASP Top Ten 2004 mapping
CWE Content Team MITRE 2008-09-08 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2008-10-14 +00:00 updated Background_Details, Description
CWE Content Team MITRE 2012-05-11 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2012-12-28 +00:00 Converted from category to weakness class.
CWE Content Team MITRE 2013-02-21 +00:00 updated Applicable_Platforms, Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, References, Relationships, Time_of_Introduction, Type
CWE Content Team MITRE 2014-06-23 +00:00 updated Observed_Examples
CWE Content Team MITRE 2014-07-30 +00:00 updated Detection_Factors
CWE Content Team MITRE 2015-12-07 +00:00 updated Relationships
CWE Content Team MITRE 2017-01-19 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Modes_of_Introduction, References, Relationships
CWE Content Team MITRE 2018-03-27 +00:00 updated Background_Details, Modes_of_Introduction, Potential_Mitigations, Relationships
CWE Content Team MITRE 2019-06-20 +00:00 updated Relationships
CWE Content Team MITRE 2019-09-19 +00:00 updated Demonstrative_Examples, Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, Relationships
CWE Content Team MITRE 2020-08-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2021-07-20 +00:00 updated Demonstrative_Examples, Observed_Examples
CWE Content Team MITRE 2021-10-28 +00:00 updated Observed_Examples, Relationships
CWE Content Team MITRE 2022-04-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated Observed_Examples, References
CWE Content Team MITRE 2023-01-31 +00:00 updated Description, Modes_of_Introduction
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-09-09 +00:00 updated Common_Consequences, Description, Detection_Factors, Diagram, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Applicable_Platforms, Observed_Examples, Relationships, Weakness_Ordinalities
Informacje prezentowane na CVE Find pochodzą z kilku starannie wybranych źródeł referencyjnych. Dane CVE są dostarczane przez MITRE Corporation i Narodową Bazę Podatności (NVD). Katalog znanych eksploatowanych podatności (KEV) pochodzi z Agencji ds. Bezpieczeństwa Cyberprzestrzeni i Infrastruktury (CISA), natomiast wyniki EPSS pochodzą z FIRST.org. Ponadto dane dotyczące słabości oprogramowania (CWE) i typowych wzorców ataków (CAPEC) są utrzymywane przez MITRE Corporation, a informacje o konfiguracjach sprzętu i oprogramowania (CPE) są dostarczane przez NVD.