User Interface (UI) Misrepresentation of Critical Information
This vulnerability occurs when a user interface fails to accurately display or highlight crucial information, potentially misleading users about the true state of the system or the source of data. Attackers exploit this weakness to trick users into performing unintended actions, often as part of phishing campaigns or other deception-based attacks.
When an application's UI misrepresents critical data—whether by showing incorrect information, obscuring it, or spoofing its origin—it breaks the user's trust in the interface. This can lead directly to security failures, such as users approving dangerous transactions, downloading malicious files, or ignoring genuine security alerts because they appear untrustworthy. Essentially, if the user cannot rely on what they see, they become vulnerable to manipulation. Common attack methods include overlaying fake elements over legitimate ones (clickjacking), manipulating file icons to hide dangerous extensions, exploiting race conditions to show false status indicators, or using visual tricks like character homographs in URLs. Developers must treat the UI as a critical security layer, ensuring it consistently and clearly communicates the true system state, source of information, and potential risks without ambiguity or omission.
Impact: Hide ActivitiesBypass Protection Mechanism
Strategy: Input Validation
Strategy: Output Encoding
- 98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
- 154Improper Neutralization of Variable Name Delimiters
- 163Improper Neutralization of Multiple Trailing Special Elements
- 164Improper Neutralization of Internal Special Elements
- 173Improper Handling of Alternate Encoding
- PLOVER