731
Adversary-in-the-Middle / AITM :
Man-in-the-Middle / MITM :
Person-in-the-Middle / PITM :
Monkey-in-the-Middle :
Monster-in-the-Middle :
On-path attack :
Interception attack :
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Access Control
Read Application Data
Modify Application Data
Gain Privileges or Assume Identity
An attacker could pose as one of the entities and read or
possibly modify the communication.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Always fully authenticate both ends of any communications channel.
Phase: Architecture and Design
Adhere to the principle of complete mediation.
Phase: Implementation
A certificate binds an identity to a cryptographic key to authenticate a communicating party.
Often, the certificate takes the encrypted form of the hash of the identity of the subject, the
public key, and information such as time of issue or expiration using the issuer's private key. The
certificate can be validated by deciphering the certificate with the issuer's public key. See also
X.509 certificate signature chains and the PGP certification structure.
Demonstrative Examples
Example 1:
In the Java snippet below, data is sent over an unencrypted channel to a remote server.
Example Language: Java (Bad)
Socket sock;
PrintWriter out;
try {
sock = new Socket(REMOTE_HOST, REMOTE_PORT);
out = new PrintWriter(echoSocket.getOutputStream(), true);
// Write data to remote host via socket output stream.
...
CWE Version 4.14
CWE-300: Channel Accessible by Non-Endpoint
CWE-300: Channel Accessible by Non-Endpoint