CWE-1293 is a design weakness about trusting a single voice. The product relies on one source of data, which removes its ability to notice that an adversary has compromised that source.
It is a process and architecture issue more than a coding slip. It applies to any system that asks an outside party a question and acts on the answer: a time server, a certificate check, a price feed, a package index, a policy service.
How it happens
To work at all, a product sometimes has to trust the integrity of an information source. That is normal. The trouble is what the trust covers.
MITRE separates two properties that people often blur. When information is signed, you can ensure the data was not tampered with in transit. That does not tell you whether the information source itself was compromised when it produced the response. A signature proves who spoke and that the words arrived intact. It says nothing about whether the speaker was telling the truth.
The remedy MITRE describes is to request the information from multiple sources and compare the answers. If all the answers match, confidence rises. If they differ, the system should report the sources that returned a different or minority value as potentially compromised. If there are not enough answers to produce a majority or plurality, the system should report all of the sources as potentially compromised.
A product that skips this and asks once has no way to tell a good answer from a planted one.
MITRE gives a concrete case in the consequences. An attacker who can carry out a single person-in-the-middle attack can subvert a check of an external oracle. Its example is the ACME protocol check for a file on a website. With only one vantage point, the attacker only has to control that one path.
What an attacker gains
MITRE rates the likelihood of exploit as high. The listed consequences are reading application data, modifying application data, and gaining privileges or assuming identity, with confidentiality and integrity affected.
In practical terms, the attacker can make the product believe a false answer. That might mean passing a verification they should fail or injecting data the product then treats as genuine.
How to find it
The record lists no detection methods. A review can use the failure list from MITRE's implementation guidance as a checklist:
- Is data fetched by a method that checks more than one source for the same fact?
- Is there a place to report potentially compromised information sources?
- Are the sources really independent, or do they share a network path, an operator or an upstream, so one compromise affects all of them?
- Are sources that answer with a minority value reported to incident response?
Pay attention to the independence question. Three mirrors that all pull from the same upstream are one source wearing three names.
How to fix it
MITRE's mitigation sits in requirements and implementation. In requirements, design the system to use a Practical Byzantine fault method: request the information from multiple sources, verify the data, and report on potentially compromised sources. In implementation, avoid these failures:
- Not using a Practical Byzantine fault method when requesting data.
- Having no place to report potentially compromised sources.
- Relying on non-independent sources for integrity checking.
- Failing to send sources that respond with a minority value to incident response procedures.
MITRE also ties the number of sources to the stakes. As the seriousness of the impact of incorrect integrity increases, so should the number of independent information sources that need to be queried.
Here is a small illustration of the comparison step. It is a sketch to show the idea, not a full Byzantine protocol.
from collections import Counter
def correlate(answers: dict[str, str], need: int = 3):
"""answers maps source name to the value it returned."""
if len(answers) < need:
return None, list(answers) # too few: flag every source
counts = Counter(answers.values())
value, votes = counts.most_common(1)[0]
if votes <= len(answers) // 2:
return None, list(answers) # no majority: flag every source
suspects = [s for s, v in answers.items() if v != value]
return value, suspects # report minority sources
The returned suspects list is what feeds incident response. The point is that disagreement is data. Silence about it throws away the one signal a compromised source cannot hide.
One caution on cost. Querying more sources adds latency and failure modes, so scale the number to the impact, as MITRE says, rather than querying everything for every request.
Quick check
If the data is signed, is one source enough?
No. Signing shows the data was not altered in transit, but not that the source was uncompromised when it answered.
What if there is no majority among the answers?
MITRE says to report all of the sources as potentially compromised.
Why does independence matter?
If sources share a path or an upstream, one compromise can corrupt all of them, which gives the same weakness as a single source.
