1066
Confused Deputy : This weakness is sometimes referred to as the "Confused deputy" problem,
in which an attacker misused the authority of one victim (the "confused deputy") when targeting
another victim.
Common Consequences
Scope Impact Likelihood
Non-Repudiation
Access Control
Gain Privileges or Assume Identity
Hide Activities
Execute Unauthorized Code or Commands
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Enforce the use of strong mutual authentication mechanism between the two parties.
Phase: Architecture and Design
Whenever a product is an intermediary or proxy for transactions between two other components,
the proxy core should not drop the identity of the initiator of the transaction. The immutability of
the identity of the initiator must be maintained and should be forwarded all the way to the target.
Demonstrative Examples
Example 1:
A SoC contains a microcontroller (running ring-3 (least trusted ring) code), a Memory Mapped Input
Output (MMIO) mapped IP core (containing design-house secrets), and a Direct Memory Access
(DMA) controller, among several other compute elements and peripherals. The SoC implements
access control to protect the registers in the IP core (which registers store the design-house
secrets) from malicious, ring-3 (least trusted ring) code executing on the microcontroller. The DMA
controller, however, is not blocked off from accessing the IP core for functional reasons.
Example Language: Other (Bad)
The code in ring-3 (least trusted ring) of the microcontroller attempts to directly read the protected registers in IP
core through MMIO transactions. However, this attempt is blocked due to the implemented access control. Now, the
microcontroller configures the DMA core to transfer data from the protected registers to a memory region that it has access
to. The DMA core, which is acting as an intermediary in this transaction, does not preserve the identity of the microcontroller
and, instead, initiates a new transaction with its own identity. Since the DMA core has access, the transaction (and hence,
the attack) is successful.
The weakness here is that the intermediary or the proxy agent did not ensure the immutability of
the identity of the microcontroller initiating the transaction.
Example Language: Other (Good)
The DMA core forwards this transaction with the identity of the code executing on the microcontroller, which is the original
initiator of the end-to-end transaction. Now the transaction is blocked, as a result of forwarding the identity of the true
initiator which lacks the permission to access the confidential MMIO mapped IP core.
CWE Version 4.14
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')