CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How it's found
Improper Certificate Validation is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Consequences
- Bypass Protection Mechanism, Gain Privileges or Assume Identity: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Mitigations
- Architecture and Design/Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
How TurboPentest tests for this (white-box)
This weakness (Improper Certificate Validation) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 8 rules for it, flagging the issue directly in your source code as part of the pentest.
Frequently asked questions
What is CWE-295?
The product does not validate, or incorrectly validates, a certificate.
How do you find Improper Certificate Validation?
Improper Certificate Validation is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-295?
Bypass Protection Mechanism, Gain Privileges or Assume Identity: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Does TurboPentest test for Improper Certificate Validation?
This weakness (Improper Certificate Validation) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 8 rules for it, flagging the issue directly in your source code as part of the pentest.
Related CWEs
- Class weaknessCWE-287: Improper Authentication
- Base weaknessCWE-322: Key Exchange without Entity Authentication
- Base weaknessCWE-209: Generation of Error Message Containing Sensitive Information
- Base weaknessCWE-215: Insertion of Sensitive Information Into Debugging Code
- Variant weaknessCWE-219: Storage of File with Sensitive Data Under Web Root
- Base weaknessCWE-459: Incomplete Cleanup
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest