CWE-351, Insufficient Type Distinction, means the product does not properly distinguish between different types of elements, and that leads to insecure behavior. Two things that should be treated differently get treated the same.
It affects anything that handles mixed inputs: user interfaces, parsers, access control lists, message handlers. The weakness is language neutral.
How it happens
Code often collapses categories to keep things simple. An event is an event. An entry is an entry. Two objects are equal if their first fields match. The shortcut holds until someone builds an input that sits in the gap.
MITRE gives two real examples. In CVE-2005-2260, a browser user interface did not distinguish between user initiated and synthetic events. A page could fake a click and the browser acted as if a person had done it. In CVE-2005-2801, a product did not compare all required data in two separate elements, decided they were the same, and lost access control entries as a result.
What an attacker gains
The record lists the consequence only as "Other." In practice it follows what the confused element controls. If a fake event can trigger a privileged action, the attacker borrows the user's authority. If two different entries merge, protections attached to one can disappear.
How to find it
The record names no detection methods, so use review and testing.
- List every place where code branches on the kind of an input, and check the branch cannot be satisfied by a forged one.
- Look at equality and matching functions. Do they compare every field that matters, or only some?
- Test with inputs that are almost the same as a trusted element but differ in one attribute.
How to fix it
MITRE lists no mitigations for this entry. Sound practice follows from the definition.
- Carry the type with the data. Use explicit tags or distinct classes rather than inferring kind from content.
- Compare all security relevant attributes when deciding two elements are the same.
- Never let input from an untrusted source claim to be a trusted type. Set the trusted flag on your side of the boundary.
Quick check
What went wrong in the browser case, CVE-2005-2260?
The interface did not tell real user actions apart from synthetic events, so scripted activity could be treated as if a person had done it.
Sources
- MITRE CWE-351: https://cwe.mitre.org/data/definitions/351.html
