863
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Gain Privileges or Assume Identity
If an attacker can spoof the endpoint, the attacker gains all
the privileges that were intended for the original endpoint.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other
domains to access its data:
Flash crossdomain.xml :
Example Language: XML (Bad)
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*.example.com"/>
<allow-access-from domain="*"/>
</cross-domain-policy>
Silverlight clientaccesspolicy.xml :
Example Language: XML (Bad)
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
CWE Version 4.14
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints