CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Official CWE-593 CWE context with Glexia analysis, remediation guidance, related CVEs, and ATT&CK context.
Glexia's Take
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Access Control: Bypass Protection Mechanism: No authentication takes place in this process, bypassing an assumed protection of encryption.
- Confidentiality: Read Application Data: The encrypted communication between a user and a trusted host may be subject to a sniffing attack.
Developer Pattern
CWE-593 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Confidence
high confidence from CWE-593, 4.20.
Official CWE Definition
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- The following example demonstrates the weakness.
Remediation
- Architecture and Design: Use a language or a library that provides a cryptography framework at a higher level of abstraction.
- Implementation: Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
- Implementation: Applications should set up an SSL_CTX completely, before creating SSL objects from it.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.