Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-297 Variante Incompleto
Improper Validation of Certificate with Host Mismatch
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed…
Definição
What is CWE-297?
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed certificate from a trusted authority can be misused if the hostname check is missing or flawed.
When your application connects to a server, it must verify that the certificate presented matches the intended hostname. This is done by checking the Common Name (CN) or, more reliably, the Subject Alternative Name (SAN) fields in the certificate. If this validation is skipped or implemented incorrectly, an attacker with a valid certificate for a different domain can impersonate your trusted service, leading to man-in-the-middle attacks and data interception.
Common validation pitfalls include incomplete string comparisons that can be tricked by special characters, or failing to perform hostname checks when using certificate pinning. Always validate the hostname at the time of pinning and use established library functions for hostname verification instead of custom string matching, as these functions correctly handle edge cases like null bytes and wildcards.
Impacto no mundo real
Real-world CVEs caused by CWE-297
-
Mobile banking application does not verify hostname, leading to financial loss.
-
Mobile application for printing documents does not verify hostname, allowing attackers to read sensitive documents.
-
Software for electronic checking does not verify hostname, leading to financial loss.
-
Cloud-support library written in Python uses incorrect regular expression when matching hostname.
-
Web browser does not correctly handle '\0' character (NUL) in Common Name, allowing spoofing of https sites.
-
Database program truncates the Common Name during hostname verification, allowing spoofing.
-
Incorrect handling of '\0' character (NUL) in hostname verification allows spoofing.
-
Mail server's incorrect handling of '\0' character (NUL) in hostname verification allows spoofing.
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
Identificar um caminho de código que trata input não confiável sem validação.
- 2
Criar um payload que explora o comportamento inseguro — injeção, traversal, overflow ou abuso de lógica.
- 3
Entregar o payload através de um pedido normal e observar a reação da aplicação.
- 4
Iterar até que a resposta exponha dados, execute código do atacante ou escale privilégios.
Exemplo de código vulnerável
Vulnerable C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl);
if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) {
```
// do secret things*
} Exemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-297
- Architecture and Design Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
- Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Sinais de deteção
How to detect CWE-297
Set up an untrusted endpoint (e.g. a server) with which the product will connect. Create a test certificate that uses an invalid hostname but is signed by a trusted CA and provide this certificate from the untrusted endpoint. If the product performs any operations instead of disconnecting and reporting an error, then this indicates that the hostname is not being checked and the test certificate has been accepted.
When Certificate Pinning is being used in a mobile application, consider using a tool such as Spinner [REF-955]. This methodology might be extensible to other technologies.
O Plexicus deteta automaticamente o CWE-297 e abre um PR de correção em menos de 60 segundos.
O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.
Perguntas frequentes O que é o CWE-297?
Qual a gravidade do CWE-297?
Que linguagens ou plataformas são afetadas pelo CWE-297?
Como posso prevenir o CWE-297?
Como é que o Plexicus deteta e corrige o CWE-297?
Onde posso saber mais sobre o CWE-297?
Frequently asked questions
O que é o CWE-297?
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed certificate from a trusted authority can be misused if the hostname check is missing or flawed.
Qual a gravidade do CWE-297?
A MITRE classifica a probabilidade de exploração como Alta — esta fraqueza é ativamente explorada em campo e deve ser priorizada para remediação.
Que linguagens ou plataformas são afetadas pelo CWE-297?
MITRE lists the following affected platforms: Mobile, Not Technology-Specific.
Como posso prevenir o CWE-297?
Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed. If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Como é que o Plexicus deteta e corrige o CWE-297?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-297 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-297?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/297.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-297
CWE-923 Pai
Improper Restriction of Communication Channel to Intended Endpoints
This vulnerability occurs when a system opens a communication channel for a sensitive task but fails to properly verify that it's actually…
CWE-1275 Irmão
Sensitive Cookie with Improper SameSite Attribute
This vulnerability occurs when a sensitive cookie does not have a secure SameSite attribute configured, leaving it exposed to cross-site…
CWE-291 Irmão
Reliance on IP Address for Authentication
This vulnerability occurs when a system uses a client's IP address as the sole or primary method to verify their identity.
CWE-300 Irmão
Channel Accessible by Non-Endpoint
This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel…
CWE-419 Irmão
Unprotected Primary Channel
This vulnerability occurs when an application exposes a privileged administrative interface or restricted functionality through a primary…
CWE-420 Irmão
Unprotected Alternate Channel
This vulnerability occurs when an application secures its main communication path but leaves a backup or alternative channel with weaker…
CWE-940 Irmão
Improper Verification of Source of a Communication Channel
This vulnerability occurs when an application accepts incoming communication requests without properly checking where they originate from,…
CWE-941 Irmão
Incorrectly Specified Destination in a Communication Channel
This vulnerability occurs when an application establishes an outgoing communication channel but fails to correctly define or enforce the…
CWE-942 Irmão
Permissive Cross-domain Security Policy with Untrusted Domains
This vulnerability occurs when a web application's cross-domain security policy, like a Content Security Policy (CSP), explicitly allows…
Recursos
Further reading
- MITRE — CWE-297 oficial https://cwe.mitre.org/data/definitions/297.html
- The CLASP Application Security Process https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
- The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf
- Secure programming with the OpenSSL API, Part 2: Secure handshake https://developer.ibm.com/tutorials/l-openssl/?mhsrc=ibmsearch_a&mhq=secure%20programming%20with%20the%20openssl%20API
- An Introduction to OpenSSL Programming (Part I) https://www.linuxjournal.com/article/4822
Pronto quando você estiver
Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.
O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.