CWE-923 (通信信道对预期端点的不适当限制) — Vulnerability Class 67

67 vulnerabilities classified as CWE-923 (通信信道对预期端点的不适当限制). AI Chinese analysis included.

CWE-923 represents a critical architectural flaw where software fails to verify the identity of a communication endpoint, allowing connections to proceed without proper authentication or validation. Attackers typically exploit this vulnerability by spoofing the intended target’s identity, often through IP address manipulation or socket hijacking, thereby tricking the application into granting privileged access to unauthorized entities. This misdirection enables attackers to intercept sensitive data or execute malicious commands under the guise of a trusted service. To mitigate this risk, developers must implement robust endpoint verification mechanisms, such as mutual TLS authentication, strict IP whitelisting, and certificate pinning. By ensuring that every communication channel is rigorously authenticated against a known, trusted source, organizations can prevent unauthorized entities from impersonating legitimate endpoints and maintain the integrity of their network communications.

MITRE CWE Description

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.

Common Consequences (1)

Integrity, Confidentiality Gain Privileges or Assume Identity

If an attacker can spoof the endpoint, the attacker gains all the privileges that were intended for the original endpoint.

Examples (2)

These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:

<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy>

Bad · XML

<?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="SOAPAction"> <domain uri="*"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>

Bad · XML

This Android application will remove a user account when it receives an intent to do so:

IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }

Bad · Java

CVE ID	Title	CVSS	Severity	Published
CVE-2022-2835	CoreDNS 安全漏洞 — coreDNS	4.4	-	2023-03-03
CVE-2022-2663	Linux kernel 安全漏洞 — Linux kernel	-	-	2022-09-01
CVE-2022-30729	Samsung mobile 安全漏洞 — Samsung Mobile Devices	3.3	Low	2022-06-07
CVE-2021-32004	GateManager does not enforce strict hostname matching for WEB server — GateManager	3.7	Low	2021-11-22
CVE-2021-32635	Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint — singularity	6.3	Medium	2021-05-28
CVE-2019-17440	PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access — PAN-OS	10.0	Critical	2019-12-20
CVE-2018-10596	Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints — 2090 CareLink Programmer	7.1	High	2018-07-02

Vulnerabilities classified as CWE-923 (通信信道对预期端点的不适当限制) represent 67 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.