Origin Validation Error

Opis

The product does not properly verify that the source of data or communication is valid.

Skutki

• Access Control, Other

  Gain Privileges or Assume Identity; Varies by Context

  An attacker can access any functionality that is inadvertently accessible to the source.

Przykłady podatności

• CVE-2000-1218 DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2018-6074 Browser does not set Mark-of-the-Web (MotW) for a downloaded .EXE file if the name is close to the maximum path length, preventing recording of a zone identifier in the filename
• CVE-2025-0411 Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
• CVE-2025-46652 Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
• CVE-2005-0877 DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2001-1452 DNS server caches glue records received from non-delegated name servers
• CVE-2005-2188 user ID obtained from untrusted source (URL)
• CVE-2003-0174 LDAP service does not verify if a particular attribute was set by the LDAP server
• CVE-1999-1549 product does not sufficiently distinguish external HTML from internal, potentially dangerous HTML, allowing bypass using special strings in the page title. Overlaps special elements.
• CVE-2003-0981 product records the reverse DNS name of a visitor in the logs, allowing spoofing and resultant XSS.

Słabość nadrzędna

• CWE-345 Insufficient Verification of Data Authenticity
• CWE-284 Improper Access Control

Słabości podrzędne

• CWE-940 Improper Verification of Source of a Communication Channel
• CWE-1385 Missing Origin Validation in WebSockets

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based

Uwagi

This entry has some significant overlap with other CWE entries and may need some clarification. See terminology notes.

The "Origin Validation Error" term was originally used in a 1995 thesis [REF-324]. Although not formally defined, an issue is considered to be an origin validation error if either (1) "an object [accepts] input from an unauthorized subject," or (2) "the system [fails] to properly or completely authenticate a subject." A later section says that an origin validation error can occur when the system (1) "does not properly authenticate a user or process" or (2) "does not properly authenticate the shared data or libraries." The only example provided in the thesis (covered by OSVDB:57615) involves a setuid program running command-line arguments without dropping privileges. So, this definition (and its examples in the thesis) effectively cover other weaknesses such as CWE-287 (Improper Authentication), CWE-285 (Improper Authorization), and CWE-250 (Execution with Unnecessary Privileges). There appears to be little usage of this term today, except in the SecurityFocus vulnerability database, where the term is used for a variety of issues, including web-browser problems that allow violation of the Same Origin Policy and improper validation of the source of an incoming message.

Źródła

1. A Taxonomy of Security Faults in the UNIX Operating System — Taimur Aslam, 1995