Weakness · Medium
CWE-353: Missing Support for Integrity Check
What it is
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Medium
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- 1 known exploited CVE
In more detail
If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.
What an attacker can do
- Other (Integrity, Other, Non-Repudiation)
- Hide Activities (Non-Repudiation, Other)
How to prevent it
Architecture and Design
- Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
Implementation
- Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.
Exploited in the wild: 1 CVE
Vulnerabilities caused by CWE-353 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.