CWE-593: Authentication Bypass: OpenSSL CTX Object… | Glexia
CWE-593 (Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created) weakness overview with consequences, detection methods, mitigations,…
Glexia's Take · Automated analysis
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Access Control: Bypass Protection Mechanism: No authentication takes place in this process, bypassing an assumed protection of encryption.
- Confidentiality: Read Application Data: The encrypted communication between a user and a trusted host may be subject to a sniffing attack.
Developer Pattern
CWE-593 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-593, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- The following example demonstrates the weakness.
Remediation
- Architecture and Design: Use a language or a library that provides a cryptography framework at a higher level of abstraction.
- Implementation: Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
- Implementation: Applications should set up an SSL_CTX completely, before creating SSL objects from it.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.