Some tools can act as proxy servers that allow the tester to intercept packets or messages, inspect them, and modify them before sending them to the destination in order to see if the modified packets are still accepted by the receiving component.
CWE-300 Classe Rascunho
Channel Accessible by Non-Endpoint
This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel itself. This allows an unauthorized third party to access or…
Definição
What is CWE-300?
This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel itself. This allows an unauthorized third party to access or manipulate the communication as if they were a legitimate participant.
Secure communication requires confidently knowing who you're talking to at both ends of the connection. If a system performs weak, inconsistent, or missing identity checks, it can't be sure if the other party is genuine. Attackers exploit this gap by inserting themselves into the channel, impersonating a trusted endpoint. Once in the middle, they can silently eavesdrop on or alter the data flowing between the two original, unsuspecting parties.
For developers, the core issue is misplaced trust. Without robust endpoint verification—like mutual authentication—your application might share sensitive data with an impostor. To prevent this, ensure your implementation validates identities at both ends using strong, cryptographic methods and maintains the channel's integrity to block unauthorized access or tampering.
Impacto no mundo real
Real-world CVEs caused by CWE-300
-
chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversry-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
Identificar um caminho de código que trata input não confiável sem validação.
- 2
Criar um payload que explora o comportamento inseguro — injeção, traversal, overflow ou abuso de lógica.
- 3
Entregar o payload através de um pedido normal e observar a reação da aplicação.
- 4
Iterar até que a resposta exponha dados, execute código do atacante ou escale privilégios.
Exemplo de código vulnerável
Vulnerable Java
In the Java snippet below, data is sent over an unencrypted channel to a remote server.
Socket sock;
PrintWriter out;
try {
sock = new Socket(REMOTE_HOST, REMOTE_PORT);
out = new PrintWriter(echoSocket.getOutputStream(), true);
```
// Write data to remote host via socket output stream.*
...} Exemplo de código seguro
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-300
- Implementation Always fully authenticate both ends of any communications channel.
- Architecture and Design Adhere to the principle of complete mediation.
- Implementation A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.
Sinais de deteção
How to detect CWE-300
Dynamic Application Security Testing (DAST) tools can be used to detect network traffic without encryption and/or verification. The affected protocol may be subject to Adversary-in-the-Middle attacks. Some tools act as proxy servers that allow the tester to inspect and modify packets/messages to see if they are still accepted by the receiving component.
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) The analysis could identify use of protocols that are subject to Adversary-in-the-Middle attacks.
O Plexicus deteta automaticamente o CWE-300 e abre um PR de correção em menos de 60 segundos.
O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.
Perguntas frequentes O que é o CWE-300?
Qual a gravidade do CWE-300?
Que linguagens ou plataformas são afetadas pelo CWE-300?
Como posso prevenir o CWE-300?
Como é que o Plexicus deteta e corrige o CWE-300?
Onde posso saber mais sobre o CWE-300?
Frequently asked questions
O que é o CWE-300?
This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel itself. This allows an unauthorized third party to access or manipulate the communication as if they were a legitimate participant.
Qual a gravidade do CWE-300?
A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.
Que linguagens ou plataformas são afetadas pelo CWE-300?
A MITRE não especificou as plataformas afetadas por este CWE — pode aplicar-se à maioria das stacks de aplicações.
Como posso prevenir o CWE-300?
Always fully authenticate both ends of any communications channel. Adhere to the principle of complete mediation.
Como é que o Plexicus deteta e corrige o CWE-300?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-300 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-300?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/300.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-300
CWE-923 Pai
Improper Restriction of Communication Channel to Intended Endpoints
This vulnerability occurs when a system opens a communication channel for a sensitive task but fails to properly verify that it's actually…
CWE-1275 Irmão
Sensitive Cookie with Improper SameSite Attribute
This vulnerability occurs when a sensitive cookie does not have a secure SameSite attribute configured, leaving it exposed to cross-site…
CWE-291 Irmão
Reliance on IP Address for Authentication
This vulnerability occurs when a system uses a client's IP address as the sole or primary method to verify their identity.
CWE-297 Irmão
Improper Validation of Certificate with Host Mismatch
This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to…
CWE-419 Irmão
Unprotected Primary Channel
This vulnerability occurs when an application exposes a privileged administrative interface or restricted functionality through a primary…
CWE-420 Irmão
Unprotected Alternate Channel
This vulnerability occurs when an application secures its main communication path but leaves a backup or alternative channel with weaker…
CWE-940 Irmão
Improper Verification of Source of a Communication Channel
This vulnerability occurs when an application accepts incoming communication requests without properly checking where they originate from,…
CWE-941 Irmão
Incorrectly Specified Destination in a Communication Channel
This vulnerability occurs when an application establishes an outgoing communication channel but fails to correctly define or enforce the…
CWE-942 Irmão
Permissive Cross-domain Security Policy with Untrusted Domains
This vulnerability occurs when a web application's cross-domain security policy, like a Content Security Policy (CSP), explicitly allows…
Pronto quando você estiver
Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.
O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.