1829
<cross-domain-access>
<policy>
<allow-from http-request-headers="SOAPAction">
<domain uri="*"/>
</allow-from>
<grant-to>
<resource path="/" include-subpaths="true"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
These entries are far too permissive, allowing any Flash or Silverlight application to send requests.
A malicious application hosted on any other web site will be able to send requests on behalf of any
user tricked into executing it.
Example 2:
This Android application will remove a user account when it receives an intent to do so:
Example Language: Java (Bad)
IntentFilter filter = new IntentFilter("com.example.RemoveUser");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
public class DeleteReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
int userID = intent.getIntExtra("userID");
destroyUserData(userID);
}
}
This application does not check the origin of the intent, thus allowing any malicious application to
remove a user. Always check the origin of an intent, or create an allowlist of trusted applications
using the manifest.xml file.
Observed Examples
Reference Description
CVE-2022-30319 S-bus functionality in a home automation product performs access control
using an IP allowlist, which can be bypassed by a forged IP address.
https://www.cve.org/CVERecord?id=CVE-2022-30319
CVE-2022-22547 A troubleshooting tool exposes a web server on a random port between
9000-65535 that could be used for information gathering
https://www.cve.org/CVERecord?id=CVE-2022-22547
CVE-2022-4390 A WAN interface on a router has firewall restrictions enabled for IPv4, but it
does not for IPv6, which is enabled by default
https://www.cve.org/CVERecord?id=CVE-2022-4390
CVE-2012-2292 Product has a Silverlight cross-domain policy that does not restrict access to
another application, which allows remote attackers to bypass the Same Origin
Policy.
https://www.cve.org/CVERecord?id=CVE-2012-2292
CVE-2012-5810 Mobile banking application does not verify hostname, leading to financial loss.
https://www.cve.org/CVERecord?id=CVE-2012-5810
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversry-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
CWE Version 4.14
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication
Channel
CWE-924: Improper Enforcement of Message Integrity
During Transmission in a Communication Channel 1830
Reference Description
CVE-2000-1218 DNS server can accept DNS updates from hosts that it did not query, leading
to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2000-1218
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
161 Infrastructure Manipulation
481 Contradictory Destinations in Traffic Routing Schemes
501 Android Activity Hijack
697 DHCP Spoofing
CWE-924: Improper Enforcement of Message Integrity During Transmission in
a Communication Channel
Weakness ID : 924
Structure : Simple
Abstraction : Base
Description
The product establishes a communication channel with an endpoint and receives a message
from that endpoint, but it does not sufficiently ensure that the message was not modified during
transmission.
Extended Description
Attackers might be able to modify the message and spoof the endpoint by interfering with the data
as it crosses the network or by redirecting the connection to a system under their control.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1020 Verify Message Integrity 2434
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-925: Improper Verification of Intent by Broadcast Receiver
CWE-925: Improper Verification of Intent by Broadcast Receiver