CWE-346: Origin Validation Error
| Abstraction | Structure | Status |
|---|---|---|
| None | Simple | Draft |
Description
The product does not properly verify that the source of data or communication is valid.
Related Weaknesses
| Nature | ID | View ID | Name |
|---|---|---|---|
| ChildOf | CWE-345 | 1000 | Insufficient Verification of Data Authenticity |
| ChildOf | CWE-345 | 1003 | Insufficient Verification of Data Authenticity |
| ChildOf | CWE-284 | 1000 | Improper Access Control |
Modes of Introduction
| Phase | Note |
|---|---|
| Architecture and Design | - |
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Applicable Platforms
Languages
Class: Not Language-Specific
Technologies
Class: Not Technology-Specific Class: Web Based
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Access Control, Other | Gain Privileges or Assume Identity, Varies by Context | An attacker can access any functionality that is inadvertently accessible to the source. |
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect “sources” (origins of input) with “sinks” (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed Examples
- CVE-2000-1218: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
- CVE-2018-6074: Browser does not set Mark-of-the-Web (MotW) for a downloaded .EXE file if the name is close to the maximum path length, preventing recording of a zone identifier in the filename
- CVE-2025-0411: Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
- CVE-2025-46652: Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
- CVE-2005-0877: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
- CVE-2001-1452: DNS server caches glue records received from non-delegated name servers
- CVE-2005-2188: user ID obtained from untrusted source (URL)
- CVE-2003-0174: LDAP service does not verify if a particular attribute was set by the LDAP server
- CVE-1999-1549: product does not sufficiently distinguish external HTML from internal, potentially dangerous HTML, allowing bypass using special strings in the page title. Overlaps special elements.
- CVE-2003-0981: product records the reverse DNS name of a visitor in the logs, allowing spoofing and resultant XSS.