Insufficient Verification of Data Authenticity

Opis

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Skutki

• Integrity, Other

  Varies by Context; Unexpected State

Przykłady podatności

• CVE-2022-30260 Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
• CVE-2022-30267 Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
• CVE-2022-30272 Remote Terminal Unit (RTU) does not use signatures for firmware images and relies on insecure checksums

Słabość nadrzędna

• CWE-693 Protection Mechanism Failure

Słabości podrzędne

• CWE-346 Origin Validation Error
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-348 Use of Less Trusted Source
• CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
• CWE-351 Insufficient Type Distinction
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-353 Missing Support for Integrity Check
• CWE-354 Improper Validation of Integrity Check Value
• CWE-360 Trust of System Event Data
• CWE-494 Download of Code Without Integrity Check
• CWE-616 Incomplete Identification of Uploaded File Variables (PHP)
• CWE-646 Reliance on File Name or Extension of Externally-Supplied File
• CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
• CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
• CWE-1293 Missing Source Correlation of Multiple Independent Data

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, ICS/OT

Uwagi

"origin validation" could fall under this.

The specific ways in which the origin is not properly identified should be laid out as separate weaknesses. In some sense, this is more like a category.

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 15: Not Updating Easily." Page 231, McGraw-Hill, 2010
2. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022