723
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
The data read from the system vouched for by the
certificate may not be from the expected system.
Authentication
Other
Other
Trust afforded to the system in question - based on the
malicious certificate - may allow for spoofing or redirection
attacks.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
Set up an untrusted endpoint (e.g. a server) with which the product will connect. Create a test
certificate that uses an invalid hostname but is signed by a trusted CA and provide this certificate
from the untrusted endpoint. If the product performs any operations instead of disconnecting
and reporting an error, then this indicates that the hostname is not being checked and the test
certificate has been accepted.
Black Box
When Certificate Pinning is being used in a mobile application, consider using a tool such as
Spinner [REF-955]. This methodology might be extensible to other technologies.
Potential Mitigations
Phase: Architecture and Design
Fully check the hostname of the certificate and provide the user with adequate information about
the nature of the problem and how to proceed.
Phase: Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully
validated before the certificate is pinned, including the hostname.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-297: Improper Validation of Certificate with Host Mismatch