CWE-360 (信任系统事件数据) — Vulnerability Class 2

CWE-360 represents a trust relationship weakness where applications incorrectly rely on unverified system event data for critical security decisions. This vulnerability arises because event messaging systems, such as Windows messages, often lack robust authentication frameworks, allowing any process on a desktop to spoof messages intended for other windows. Attackers typically exploit this by injecting malicious event data to trick applications into performing unauthorized actions, such as elevating privileges or bypassing access controls. To mitigate this risk, developers must implement strict validation mechanisms that verify the source and integrity of incoming events rather than assuming their authenticity. Utilizing authenticated channels, digital signatures, or secure inter-process communication protocols ensures that only trusted entities can trigger sensitive operations, thereby preventing spoofing attacks and maintaining system integrity against malicious actors seeking to manipulate event-driven workflows.