Weakness · High
CWE-360: Trust of System Event Data
What it is
Security based on event locations are insecure and can be spoofed.
- Severity (our rating)
- High
- Likelihood of exploit
- High
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Events are a messaging system which may provide control data to programs listening for events. Events often do not have any type of authentication framework to allow them to be verified from a trusted source. Any application, in Windows, on a given desktop can send a message to any window on the same desktop. There is no authentication framework for these messages. Therefore, any message can be used to manipulate any process on the desktop if the process does not check the validity and safeness of those messages.
What an attacker can do
- Gain Privileges or Assume Identity (Integrity, Confidentiality, Availability, Access Control)
- Execute Unauthorized Code or Commands (Integrity, Confidentiality, Availability, Access Control)
How to prevent it
Architecture and Design
- Never trust or rely any of the information in an Event for security.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.