887
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-172]Chris Wysopal. "Mobile App Top 10 List". 2010 December 3. < https://
www.veracode.com/blog/2010/12/mobile-app-top-10-list >.2023-04-07.
[REF-1047]Wikipedia. "General Data Protection Regulation". < https://en.wikipedia.org/wiki/
General_Data_Protection_Regulation >.
[REF-1048]State of California Department of Justice, Office of the Attorney General. "California
Consumer Privacy Act (CCPA)". < https://oag.ca.gov/privacy/ccpa >.
CWE-360: Trust of System Event Data
Weakness ID : 360
Structure : Simple
Abstraction : Base
Description
Security based on event locations are insecure and can be spoofed.
Extended Description
Events are a messaging system which may provide control data to programs listening for events.
Events often do not have any type of authentication framework to allow them to be verified
from a trusted source. Any application, in Windows, on a given desktop can send a message to
any window on the same desktop. There is no authentication framework for these messages.
Therefore, any message can be used to manipulate any process on the desktop if the process
does not check the validity and safeness of those messages.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
ParentOf 422 Unprotected Windows Messaging Channel ('Shatter') 1022
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Access Control
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
CWE Version 4.14
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race
Condition')
CWE-362: Concurrent Execution using Shared Resource
with Improper Synchronization ('Race Condition') 888
Scope Impact Likelihood
If one trusts the system-event information and executes
commands based on it, one could potentially take actions
based on a spoofed identity.
Potential Mitigations
Phase: Architecture and Design
Never trust or rely any of the information in an Event for security.
Demonstrative Examples
Example 1:
This example code prints out secret information when an authorized user activates a button:
Example Language: Java (Bad)
public void actionPerformed(ActionEvent e) {
if (e.getSource() == button) {
System.out.println("print out secret information");
}
}
This code does not attempt to prevent unauthorized users from activating the button. Even if the
button is rendered non-functional to unauthorized users in the application UI, an attacker can easily
send a false button press event to the application window and expose the secret information.
Observed Examples
Reference Description
CVE-2004-0213 Attacker uses Shatter attack to bypass GUI-enforced protection for
CVE-2003-0908.
https://www.cve.org/CVERecord?id=CVE-2004-0213
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Trust of system event data
Software Fault Patterns SFP29 Faulty endpoint authentication
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-362: Concurrent Execution using Shared Resource with Improper
Synchronization ('Race Condition')
Weakness ID : 362
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race
Condition')
CWE-362: Concurrent Execution using Shared Resource
with Improper Synchronization ('Race Condition')