CWE-299 (证书撤销验证不恰当) — Vulnerability Class 16

CWE-299 represents a critical cryptographic weakness where software fails to verify the revocation status of a digital certificate before establishing a secure connection. This flaw is typically exploited by attackers who obtain or compromise a valid certificate, then revoke it to mask malicious activity or use it in conjunction with other vulnerabilities. By ignoring revocation checks, an application may trust a compromised certificate, allowing an attacker to perform man-in-the-middle attacks or impersonate legitimate services without detection. To mitigate this risk, developers must implement robust certificate validation processes that actively query Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responders. Ensuring these checks occur during every handshake prevents the acceptance of revoked credentials, thereby maintaining the integrity and authenticity of encrypted communications against sophisticated threats.