The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2022-30319
S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
CVE: CVE-2022-22547
A troubleshooting tool exposes a web server on a random port between 9000-65535 that could be used for information gathering
CVE: CVE-2022-4390
A WAN interface on a router has firewall restrictions enabled for IPv4, but it does not for IPv6, which is enabled by default
CVE: CVE-2012-2292
Product has a Silverlight cross-domain policy that does not restrict access to another application, which allows remote attackers to bypass the Same Origin Policy.
CVE: CVE-2012-5810
Mobile banking application does not verify hostname, leading to financial loss.
CVE: CVE-2014-1266
chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversry-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
CVE: CVE-2000-1218
DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
| Phase | Note |
|---|---|
| Architecture and Design | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Intro: These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:
Body: Flash crossdomain.xml :
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy>Intro: This Android application will remove a user account when it receives an intent to do so:
Body: This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }