33 vulnerabilities classified as CWE-441 (未有动机的代理或中间人(混淆代理)). AI Chinese analysis included.
CWE-441 represents a design flaw where a system acts as an unintended intermediary, failing to preserve the original requestor’s identity when forwarding messages to external actors. This weakness allows attackers to exploit the system by manipulating upstream components to issue malicious requests that appear to originate from the trusted application itself. Consequently, the vulnerable software performs actions on behalf of the attacker, potentially bypassing access controls or triggering unintended side effects within protected resources. To mitigate this risk, developers must implement robust identity preservation mechanisms, such as cryptographic signing or secure token passing, ensuring that the true source of every request is explicitly validated and maintained throughout the communication chain. By strictly enforcing source authentication and avoiding blind forwarding, organizations can prevent their systems from being coerced into acting as confused deputies for unauthorized operations.
The code in ring-3 (least trusted ring) of the
microcontroller attempts to directly read the protected
registers in IP core through MMIO transactions. However,
this attempt is blocked due to the implemented access
control. Now, the microcontroller configures the DMA core
to transfer data from the protected registers to a memory
region that it has access to. The DMA core, which is
acting as an intermediary in this transaction, does not
The DMA
core forwards this transaction with the identity of the
code executing on the microcontroller, which is the
original initiator of the end-to-end transaction. Now the
transaction is blocked, as a result of forwarding the
identity of the true initiator which lacks the permission
to access the confidential MMIO mapped IP core.Vulnerabilities classified as CWE-441 (未有动机的代理或中间人(混淆代理)) represent 33 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.