1188
mysql_close();
return false;
}
}
This code does not verify that the external domain accessed is the intended one. An attacker may
somehow cause the external domain name to resolve to an attack server, which would provide
the information for a false database. The attacker may then steal the usernames and encrypted
passwords from real user login attempts, or simply allow themself to access the application without
a real user account.
This example is also vulnerable to an Adversary-in-the-Middle AITM (CWE-300) attack.
Observed Examples
Reference Description
CVE-2019-9534 Satellite phone does not validate its firmware image.
https://www.cve.org/CVERecord?id=CVE-2019-9534
CVE-2021-22909 Chain: router's firmware update procedure uses curl with "-k" (insecure) option
that disables certificate validation (CWE-295), allowing adversary-in-the-middle
(AITM) compromise with a malicious firmware image (CWE-494).
https://www.cve.org/CVERecord?id=CVE-2021-22909
CVE-2008-3438 OS does not verify authenticity of its own updates.
https://www.cve.org/CVERecord?id=CVE-2008-3438
CVE-2008-3324 online poker client does not verify authenticity of its own updates.
https://www.cve.org/CVERecord?id=CVE-2008-3324
CVE-2001-1125 anti-virus product does not verify automatic updates for itself.
https://www.cve.org/CVERecord?id=CVE-2001-1125
CVE-2002-0671 VOIP phone downloads applications from web sites without verifying integrity.
https://www.cve.org/CVERecord?id=CVE-2002-0671
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 802 2010 Top 25 - Risky Resource Management 800 2354
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 865 2011 Top 25 - Risky Resource Management 900 2371
MemberOf 884 CWE Cross-section 884 2567
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Notes
Research Gap
This is critical for mobile code, but it is likely to become more and more common as developers
continue to adopt automated, network-based product distributions and upgrades. Software-asa-
Service (SaaS) might introduce additional subtleties. Common exploitation scenarios may
include ad server compromises and bad upgrades.
CWE Version 4.14
CWE-495: Private Data Structure Returned From A Public Method
CWE-495: Private Data Structure Returned From A Public Method