CWE-295 Improper Certificate Validation Analysis and POC Examples

Vulnerability Overview Vulnerability Name: CWE-295: Improper Certificate Validation Description: The product does not validate or incorrectly validates certificates. This can lead to an attacker deceiving trusted entities by interfering with the communication between a host and a client in the communication path. The product may connect to a malicious host while believing it to be a trusted host, or the product may receive spoofed data appearing to come from a trusted host. Impact Scope Impact Scope: Integrity, Authentication Specific Impact: When a certificate is invalid or malicious, an attacker may deceive trusted entities by interfering with communication between the host and client in the communication path. The product may connect to a malicious host believing it to be trusted, or the product may receive spoofed data that appears to originate from a trusted host. Remediation Architecture and Design: Certificates should be carefully managed and inspected to ensure that data is encrypted using the public key of the intended owner. Implementation: If certificate pinning is used, ensure that all relevant attributes of the certificate, including the hostname, are fully validated before pinning the certificate. POC Code Example 1 Explanation: In this case, because the certificate is self-signed, there is no external authority to verify the identity of the host. The program might communicate with different systems of the spoofing host, for example, by modifying traffic from server to client through DNS cache poisoning or a Man-in-the-Middle (MITM) attack. Example 2 Explanation: Although the "verify" step returns X509_V_OK, this step does not include checking if the Common Name matches the hostname. That is, there is no guarantee that the certificate was issued for the desired host. An SSL connection may be established with a malicious host providing a valid certificate. Example 3 Explanation: If returns , it means the certificate has expired. As time passes, the opportunities for an attacker to exploit the certificate increase. Example 4 Explanation: Because this code does not use to check the certificate, it may accept revoked certificates ( ). The software may communicate with a malicious host. Example 5 Explanation: Note that the code does not call , which effectively disables the verification step for checking the certificate. Other Information Related Vulnerabilities: Includes improper authentication, improper certificate chain trust, improper certificate validation, etc. Background Details: A certificate is a token that associates an identity (subject) with a cryptographic key. Certificates can be used to verify whether a public key belongs to the assumed owner. Entry Mode: This weakness can occur during the implementation phase after it is introduced in the architecture and design phases. Applicable Platforms: Language-independent, Technology-independent, Web-based, Mobile. Detection Methods: Includes bytecode weakness analysis, binary/bytecode disassembly, manual source code review, etc. Membership: Related to OWASP Top Ten 2004, 2017, 2021, and other classifications. Vulnerability Mapping Description: This CWE entry is at a basic abstraction level and is suitable for mapping to the root cause of vulnerabilities. Classification Mapping: Related to OWASP Top Ten 2004's A10 - Unsecure Configuration Management. Related Attack Patterns: Includes creating a spoofed Certificate Authority certificate, signature deception through improper validation, etc. References: Includes Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security by Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith, Lars Baumgartner, and Bernd Freisleben. Content History: Submitted on July 19, 2006, by the CWE community.

Goal Reached Thanks to every supporter — we hit 100%!

CWE-295 Improper Certificate Validation Analysis and POC Examples