CWE-297 (对宿主不匹配的证书验证不恰当) — Vulnerability Class 64

CWE-297 represents a critical validation weakness where software fails to verify that an SSL/TLS certificate’s identity matches the intended host. This flaw allows attackers to exploit the trust relationship by presenting a valid, properly signed certificate issued for a different domain. Consequently, malicious actors can perform man-in-the-middle attacks, intercepting sensitive data or injecting malicious content without triggering security warnings. Developers prevent this vulnerability by implementing strict hostname verification during the TLS handshake. This process involves comparing the server’s hostname against the Common Name or Subject Alternative Name fields in the certificate. By ensuring the certificate explicitly authorizes the specific host being contacted, applications maintain data integrity and confidentiality, effectively neutralizing impersonation attempts even when the certificate chain itself is technically valid.