CWE-353: Missing Support for Integrity Check | Glexia
CWE-353 (Missing Support for Integrity Check) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK context.
Glexia's Take · Automated analysis
CWE-353: Missing Support for Integrity Check
Missing Support for Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Integrity,Other: Other: Data that is parsed and used may be corrupted.
- Non-Repudiation,Other: Hide Activities,Other: Without a checksum it is impossible to determine if any changes have been made to the data after it was sent.
Developer Pattern
CWE-353 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-353, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-353: Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- In this example, a request packet is received, and privileged information is sent to the requester: The response containing secret data has no integrity check associated with it, allowing an attacker to alter the message without detection.
Remediation
- Architecture and Design: Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
- Implementation: Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.