CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
How it's found
Missing Validation of OpenSSL Certificate is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Consequences
- Read Application Data: The data read may not be properly secured - it might be viewed by an attacker.
- Bypass Protection Mechanism, Gain Privileges or Assume Identity: Trust afforded to the system in question may allow for spoofing or redirection attacks.
- Gain Privileges or Assume Identity: If the certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data under the guise of a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. In order to ensure data integrity, we must check that the certificate is valid, and that it pertains to the site we wish to access.
Mitigations
- Architecture and Design: Ensure that proper authentication is included in the system design.
- Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-599?
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
How do you find Missing Validation of OpenSSL Certificate?
Missing Validation of OpenSSL Certificate is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-599?
Read Application Data: The data read may not be properly secured - it might be viewed by an attacker. Bypass Protection Mechanism, Gain Privileges or Assume Identity: Trust afforded to the system in question may allow for spoofing or redirection attacks. Gain Privileges or Assume Identity: If the certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data under the guise of a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. In order to ensure data integrity, we must check that the certificate is valid, and that it pertains to the site we wish to access.
Does TurboPentest test for Missing Validation of OpenSSL Certificate?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest