|
|
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking Status: Incomplete Weakness ID: 649 (Weakness Base)Description Summary The software uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the software does not use integrity checks to detect if those inputs have been modified. Extended Description When an application relies on obfuscation or incorrectly applied / weak encryption to protect client controllable tokens or parameters, that may have an effect on the user state, system state or some decision made on the server. Without protecting the tokens/parameters for integrity, the application is vulnerable to an attack where an adversary blindly traverses the space of possible values of the said token/parameter in order to attempt to gain an advantage. The goal of the attacker is to find another admissible value that will somehow elevate his or her privileges in the system, disclose information or change the behavior of the system in some way beneficial to the attacker. If the application fails to protect these critical tokens/parameters for integrity, it will not be able to determine that these values have been tampered with. Measures that are used to protect data for confidentiality should not be relied upon to provide the integrity service. Likelihood of Exploit High Common Consequences Elevation of Privilege Information Disclosure Functionality Abuse Enabling Factors for Exploitation The application uses client controllable tokens/parameters in order to make decisions on the server side about user state, system state or other decisions related to the functionality of the application. The application fails to protect client controllable tokens/parameters for integrity and thus not able to catch tampering. Potential Mitigations Protect important client controllable tokens/parameters for integrity using PKI methods (i.e. digital signatures) or other means, and checks for integrity on the server side. Repeated requests from a particular user that include invalid values of tokens/parameters (those that should not be changed manually by users) should result in the user account lockout. Client side tokens/parameters should not be such that it would be easy/predictable to guess another valid state Obfuscation should not be relied upon. If encryption is used, it needs to be properly applied (i.e. proven algorithm and implementation, use padding, use random initialization vector, user proper encryption mode). Even with proper encryption where the ciphertext does not leak information about the plaintext or reveal its structure compromising integrity is possible (although less likely) without the provision of the integrity service. Observed Examples
Relationships
Applicable Platforms Languages All Time of Introduction  Architecture and Design ImplementationContent History Modifications CWE Content Team. MITRE. 2008-09-08. (Internal) updated Common_Consequences, Relationships, Observed_Example CWE Content Team. MITRE. 2008-10-14. (Internal) updated Description Previous Entry Names Relying on Obfuscation or Encryption with no Integrity Checking to Protect User Controllable Parameters that are Used to Determine User or System State (changed 2008-04-11) |
|
|
|||
