CWE-296: Improper Following of a Certificate's Chain of… | Glexia
CWE-296 (Improper Following of a Certificate's Chain of Trust) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK…
Glexia's Take · Automated analysis
CWE-296: Improper Following of a Certificate's Chain of Trust
Improper Following of a Certificate's Chain of Trust represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Non-Repudiation: Hide Activities: Exploitation of this flaw can lead to the trust of data that may have originated with a spoofed source.
- Integrity,Confidentiality,Availability,Access Control: Gain Privileges or Assume Identity,Execute Unauthorized Code or Commands: Data, requests, or actions taken by the attacking entity can be carried out as a spoofed benign entity.
Developer Pattern
CWE-296 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-296, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-296: Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- This code checks the certificate of a connected peer. In this case, because the certificate is self-signed, there was no external authority that could prove the identity of the host. The program could be communicating with a different system that is spoofing the host, e.g. by poisoning the DNS cache or using an Adversary-in-the-Middle (AITM) attack to modify the traffic from server to client.
Remediation
- Architecture and Design: Ensure that proper certificate checking is included in the system design.
- Implementation: Understand, and properly implement all checks necessary to ensure the integrity of certificate trust integrity.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the full chain of trust.
Detection
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.