Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-297 Variante Incompleto
Improper Validation of Certificate with Host Mismatch
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed…
Definición
What is CWE-297?
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed certificate from a trusted authority can be misused if the hostname check is missing or flawed.
When your application connects to a server, it must verify that the certificate presented matches the intended hostname. This is done by checking the Common Name (CN) or, more reliably, the Subject Alternative Name (SAN) fields in the certificate. If this validation is skipped or implemented incorrectly, an attacker with a valid certificate for a different domain can impersonate your trusted service, leading to man-in-the-middle attacks and data interception.
Common validation pitfalls include incomplete string comparisons that can be tricked by special characters, or failing to perform hostname checks when using certificate pinning. Always validate the hostname at the time of pinning and use established library functions for hostname verification instead of custom string matching, as these functions correctly handle edge cases like null bytes and wildcards.
Impacto en el mundo real
Real-world CVEs caused by CWE-297
-
Mobile banking application does not verify hostname, leading to financial loss.
-
Mobile application for printing documents does not verify hostname, allowing attackers to read sensitive documents.
-
Software for electronic checking does not verify hostname, leading to financial loss.
-
Cloud-support library written in Python uses incorrect regular expression when matching hostname.
-
Web browser does not correctly handle '\0' character (NUL) in Common Name, allowing spoofing of https sites.
-
Database program truncates the Common Name during hostname verification, allowing spoofing.
-
Incorrect handling of '\0' character (NUL) in hostname verification allows spoofing.
-
Mail server's incorrect handling of '\0' character (NUL) in hostname verification allows spoofing.
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
Identifica una ruta de código que maneje entrada no confiable sin validación.
- 2
Crea un payload que ejercite el comportamiento inseguro — inyección, traversal, overflow o abuso de lógica.
- 3
Envía el payload a través de una solicitud normal y observa la reacción de la aplicación.
- 4
Itera hasta que la respuesta filtre datos, ejecute código del atacante o escale privilegios.
Ejemplo de código vulnerable
Vulnerable C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl);
if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) {
```
// do secret things*
} Ejemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-297
- Architecture and Design Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
- Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Señales de detección
How to detect CWE-297
Set up an untrusted endpoint (e.g. a server) with which the product will connect. Create a test certificate that uses an invalid hostname but is signed by a trusted CA and provide this certificate from the untrusted endpoint. If the product performs any operations instead of disconnecting and reporting an error, then this indicates that the hostname is not being checked and the test certificate has been accepted.
When Certificate Pinning is being used in a mobile application, consider using a tool such as Spinner [REF-955]. This methodology might be extensible to other technologies.
Plexicus detecta automáticamente CWE-297 y abre un PR de corrección en menos de 60 segundos.
Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.
Preguntas frecuentes ¿Qué es CWE-297?
¿Qué gravedad tiene CWE-297?
¿Qué lenguajes o plataformas se ven afectados por CWE-297?
¿Cómo puedo prevenir CWE-297?
¿Cómo detecta y corrige Plexicus CWE-297?
¿Dónde puedo aprender más sobre CWE-297?
Frequently asked questions
¿Qué es CWE-297?
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed certificate from a trusted authority can be misused if the hostname check is missing or flawed.
¿Qué gravedad tiene CWE-297?
MITRE califica la probabilidad de explotación como Alta — esta debilidad se explota activamente en la práctica y debe priorizarse para su remediación.
¿Qué lenguajes o plataformas se ven afectados por CWE-297?
MITRE lists the following affected platforms: Mobile, Not Technology-Specific.
¿Cómo puedo prevenir CWE-297?
Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed. If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
¿Cómo detecta y corrige Plexicus CWE-297?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-297 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-297?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/297.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-297
CWE-923 Padre
Improper Restriction of Communication Channel to Intended Endpoints
This vulnerability occurs when a system opens a communication channel for a sensitive task but fails to properly verify that it's actually…
CWE-1275 Hermano
Sensitive Cookie with Improper SameSite Attribute
This vulnerability occurs when a sensitive cookie does not have a secure SameSite attribute configured, leaving it exposed to cross-site…
CWE-291 Hermano
Reliance on IP Address for Authentication
This vulnerability occurs when a system uses a client's IP address as the sole or primary method to verify their identity.
CWE-300 Hermano
Channel Accessible by Non-Endpoint
This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel…
CWE-419 Hermano
Unprotected Primary Channel
This vulnerability occurs when an application exposes a privileged administrative interface or restricted functionality through a primary…
CWE-420 Hermano
Unprotected Alternate Channel
This vulnerability occurs when an application secures its main communication path but leaves a backup or alternative channel with weaker…
CWE-940 Hermano
Improper Verification of Source of a Communication Channel
This vulnerability occurs when an application accepts incoming communication requests without properly checking where they originate from,…
CWE-941 Hermano
Incorrectly Specified Destination in a Communication Channel
This vulnerability occurs when an application establishes an outgoing communication channel but fails to correctly define or enforce the…
CWE-942 Hermano
Permissive Cross-domain Security Policy with Untrusted Domains
This vulnerability occurs when a web application's cross-domain security policy, like a Content Security Policy (CSP), explicitly allows…
Recursos
Further reading
- MITRE — CWE-297 oficial https://cwe.mitre.org/data/definitions/297.html
- The CLASP Application Security Process https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
- The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf
- Secure programming with the OpenSSL API, Part 2: Secure handshake https://developer.ibm.com/tutorials/l-openssl/?mhsrc=ibmsearch_a&mhq=secure%20programming%20with%20the%20openssl%20API
- An Introduction to OpenSSL Programming (Part I) https://www.linuxjournal.com/article/4822
Listo cuando tú lo estés
Deja de pagar por desarrollador.
Empieza a cerrar el bucle.
Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.