Insufficient Verification of Data Authenticity [CWE-345]

Insufficient Verification of Data Authenticity weakness describes improper or absent verification of input data authenticity.

Created: December 11, 2013
Latest Update: December 28, 2020

Table of Content

1. Description
2. Potential impact
3. Attack patterns
4. Affected software
5. Exploitation Examples
6. Severity and CVSS Scoring
7. Mitigations
8. References
9. Latest Related Security Advisories

Want to have an in-depth understanding of all modern aspects of
Insufficient Verification of Data Authenticity [CWE-345]? Read carefully this article and bookmark it to get back later, we regularly update this page.

1. Description

This class of weaknesses is a result of trust issues between data exchange parties. If application fails to verify data origin or its authenticity, an attacker might be able to perform spoofing attacks against vulnerable application or its clients. Lack of data authenticity verification may arise in a variety of situations and most likely to be introduced at design and implementation stages of application development process.

CWE-345 should be considered as a class of weaknesses and it’s a parent element for such entries as Cross-sire Request Forgery.

In this paper we will try to cover most common cases of this weakness and provide possible workarounds and mitigation techniques.

Server-side vulnerabilities

Server applications are designed to work with multiple clients. If such application fails to correctly verify its clients, a malicious user might leverage this weakness and perform certain unauthorized actions.

Client-side vulnerabilities

Client applications that do not verify authenticity of server application are also prone to this weakness. Great example of this vulnerability in client-side applications is Man-in-the-Middle attack, where an attacker is able to spoof server identity and perform certain actions against clients.

2. Potential impact

An attacker who controls user input or is able to influence network connectivity can perform a variety of actions and gain access to potentially sensitive information or event execute arbitrary code on vulnerable system.

3. Attack patterns

An attacker might use the following attack patterns to exploit this weakness:

• CAPEC-4: Using Alternative IP Address Encodings
• CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
• CAPEC-141: Cache Poisoning
• CAPEC-142: DNS Cache Poisoning
• CAPEC-209: Cross-Site Scripting Using MIME Type Mismatch
• CAPEC-218: Spoofing of UDDI/ebXML Messages
• CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
• CAPEC-385: Transaction or Event Tampering via Application API Manipulation
• CAPEC-386: Application API Navigation Remapping
• CAPEC-387: Navigation Remapping To Propagate Malicoius Content
• CAPEC-388: Application API Button Hijacking
• CAPEC-389: Content Spoofing Via Application API Manipulation

This weakness is partially described under WASC-37 (Session Fixation) in WASC Threat Classification.

4. Affected software

Any application that handles input data can be vulnerable to this weakness.

5. Exploitation Examples

We will demonstrate exploitation of insufficient validation of data authenticity against a popular content management system Bitrix Site Manager. Security advisory HTB23183 describes vulnerability in e-Store Module of Bitrix Site Manager.

/bitrix/modules/sale/general/basket.php script is using the BITRIX_SM_SALE_UID cookie to identify a guest user as shown on the image below:

Let’s create a new order using different browser and then increase the value of the BITRIX_SM_SALE_UID cookie by 1:

This example demonstrates how an attacker can spoof identity of a valid customer and view contents of arbitrary basket.

6. Severity and CVSS Scoring

Insufficient verification of data authenticity may lead to different impacts and should be scored considering maximum possible impact. Access complexity in client applications is usually set to medium due to possible complication in exploitation process.

Remote Code Execution

A remote code execution vulnerability in server application should be scored as follows:
9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) – Critical severity.

Content Spoofing

4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) – Medium severity.

Information Disclosure Vulnerability

4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) – Medium severity.

Data Manipulation Vulnerability

6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) – Medium severity.

7. Mitigations

The only way to protect application against this weakness is to perform additional checks on data authenticity. When developing the application consider all possible input data sources and use unique tokens to validate user input, always verify client and server identity.

8. References

1. CWE-345: Insufficient Verification of Data Authenticity [cwe.mitre.org]

9. Insufficient Verification of Data Authenticity Vulnerabilities, Exploits and Examples

• HTB23183: User Identity Spoofing in Bitrix Site Manager

Copyright Disclaimer: Any above-mentioned content can be copied and used for non-commercial purposes only if proper credit to ImmuniWeb is given.