CWE-942 (过度许可的跨域白名单) — Vulnerability Class 61

CWE-942 represents a critical configuration weakness where web applications implement cross-domain security mechanisms, such as Content Security Policy or cross-origin resource sharing rules, but erroneously permit communication with untrusted domains. This flaw typically allows attackers to exploit the overly permissive policy by injecting malicious scripts or data from a compromised third-party domain, bypassing the browser’s same-origin policy to steal sensitive user data or execute unauthorized actions. Developers can prevent this vulnerability by strictly defining allowlists that include only verified, trusted sources, avoiding the use of wildcards or broad domain patterns that inadvertently grant access to malicious entities. Rigorous validation of domain configurations during development and continuous monitoring of policy enforcement ensure that cross-domain requests remain confined to legitimate, secure endpoints, thereby maintaining the integrity of the application’s security boundary.