1342
Weakness ID : 599
Structure : Simple
Abstraction : Variant
Description
The product uses OpenSSL and trusts or uses a certificate without using the
SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security
requirements.
Extended Description
This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired
certificates, or conduct other attacks that could be detected if the certificate is properly validated.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 295 Improper Certificate Validation 714
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
The data read may not be properly secured, it might be
viewed by an attacker.
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
Trust afforded to the system in question may allow for
spoofing or redirection attacks.
Access Control Gain Privileges or Assume Identity
If the certificate is not checked, it may be possible for a
redirection or spoofing attack to allow a malicious host
with a valid certificate to provide data under the guise of
a trusted host. While the attacker in question may have
a valid certificate, it may simply be a valid certificate for
a different site. In order to ensure data integrity, we must
check that the certificate is valid, and that it pertains to the
site we wish to access.
Potential Mitigations
Phase: Architecture and Design
Ensure that proper authentication is included in the system design.
Phase: Implementation
Understand and properly implement all checks necessary to ensure the identity of entities
involved in encrypted communications.
Demonstrative Examples
CWE Version 4.14
CWE-600: Uncaught Exception in Servlet
CWE-600: Uncaught Exception in Servlet