CWE - CWE-441: Unintended Proxy/Intermediary (1.6)

Home > CWE List > CWE- Individual Dictionary Definition (1.6)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWE/SANS Top 25
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-441: Unintended Proxy/Intermediary

Unintended Proxy/Intermediary

Weakness ID: 441 (Weakness Base)

Status: Draft

Description

Description Summary

A product can be used as an intermediary or proxy between an attacker and the ultimate target, so that the attacker can either bypass access controls or hide activities.

Time of Introduction

Architecture and Design

Applicable Platforms

Languages

All

Observed Examples

Reference	Description
CVE-1999-0168	Portmapper could redirect service requests from an attacker to another entity, which thinks the requests came from the portmapper.
CVE-2005-0315	FTP server does not ensure that the IP address in a PORT command is the same as the FTP user's session, allowing port scanning by proxy.
CVE-2002-1484	Web server allows attackers to request a URL from another server, including other ports, which allows proxied scanning.
CVE-2004-2061	CGI script accepts and retrieves incoming URLs.
CVE-2001-1484	MFV - bounce attack allows access to TFTP from trusted side.
CVE-1999-0017	FTP bounce attack. Protocol allows attacker to modify the PORT command to cause the FTP server to connect to other machines besides the attacker's. Similar to proxied trusted channel.

Potential Mitigations

Phase	Description
	Enforce the use of strong mutual authentication mechanism between the two parties.

Other Notes

Property: Alternate Channel

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Category	418	Channel Errors	Development Concepts (primary)699
ChildOf	Weakness Class	610	Externally Controlled Reference to a Resource in Another Sphere	Research Concepts (primary)1000
RequiredBy	Compound Element: Composite	352	Cross-Site Request Forgery (CSRF)	Research Concepts1000
RequiredBy	Compound Element: Composite	384	Session Fixation	Research Concepts1000

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER			Unintended proxy/intermediary
PLOVER			Proxied Trusted Channel

Maintenance Notes

This entry is currently a child of CWE-610 under view 1000, however there is also a relationship with CWE-668 because the resulting proxy effectively exposes the victims control sphere to the attacker. This should possibly be considered as an emergent resource.

Content History

Submissions
Submission Date	Submitter	Organization	Source
	PLOVER		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Potential Mitigations, Time of Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Relationships, Observed Example, Other Notes, Taxonomy Mappings
2008-11-24	CWE Content Team	MITRE	Internal
2008-11-24	updated Maintenance Notes, Relationships, Taxonomy Mappings, Time of Introduction

Page Last Updated: October 29, 2009


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us