Description
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Potential Impact
- Access Control: Gain Privileges or Assume Identity
- Authentication: Other
How to Fix
Architecture and Design
Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
- Dynamic Analysis with Manual Results Interpretation: Set up an untrusted endpoint (e.g. a server) with which the product will connect. Create a test certificate that uses an invalid hostname but is signed by a trusted CA and provide this certificate fr...
- Black Box: When Certificate Pinning is being used in a mobile application, consider using a tool such as Spinner [REF-955]. This methodology might be extensible to other technologies....
Related Weaknesses
References
View on MITRE CWE Database →
