目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-942 过度许可的跨域白名单 类漏洞列表 91

CWE-942 过度许可的跨域白名单 类弱点 91 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-942属于跨域安全策略配置错误漏洞。当Web应用允许与不受信任的域进行通信时，攻击者可利用该缺陷通过恶意域窃取敏感数据或执行未授权操作。开发者应避免在内容安全策略或跨域策略文件中包含通配符或不可信域名，严格限制允许通信的源，确保仅信任已知且安全的域，从而防止跨域数据泄露。

MITRE CWE 官方描述
CWE：CWE-942 对不受信任域采用宽松跨域安全策略 产品使用了 Web 客户端保护机制，例如内容安全策略（Content Security Policy, CSP）或跨域策略文件，但该策略包含了允许 Web 客户端与之通信的不受信任域。 如果跨域策略文件包含了不应被信任的域，例如在高阶域下使用通配符时，则应用程序可能受到这些不受信任域的攻击。在许多情况下，攻击可以在受害者毫无察觉的情况下发起。
常见影响 (1)
Confidentiality, Integrity, Availability, Access Control Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context
With an overly permissive policy file, an attacker may be able to bypass the web browser's same-origin policy and conduct many of the same attacks seen in Cross-Site Scripting (CWE-79). An attacker can exploit the weakness to transfer private information from the victim's machine to the attacker, ma…
缓解措施 (3)
Architecture and Design, Operation Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
Architecture and Design, Operation Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
Architecture and Design, Operation For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.
代码示例 (1)
These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy>
Bad · XML
<?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="SOAPAction"> <domain uri="*"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>
Bad · XML
CVE ID 标题 CVSS 风险等级 Published
CVE-2019-14860 Red Hat Fuse 输入验证错误漏洞 — syndesis 7.1 - 2019-11-08

CWE-942（过度许可的跨域白名单） 是常见的弱点类别，本平台收录该类弱点关联的 91 条 CVE 漏洞。