CWE-356, Product UI does not Warn User of Unsafe Actions, covers an interface that acts on the user's behalf without warning them first. That makes it easier for attackers to trick people into hurting their own system.
If you build anything that opens, runs, imports or installs content from somewhere else, this one is yours.
How it happens
The software has a dangerous capability. Opening a document that carries macros. Running a file from an unknown source. The designer decided the common case should be quick, so there is no prompt.
MITRE's example is blunt: if a user downloads a file from an unknown source and tries to run it, the interface should indicate that the file is unsafe. The observed CVEs show the older version of the story. CVE-1999-1055, CVE-1999-0794 and CVE-2000-0277 all describe products that did not warn the user when a document contained certain dangerous functions or macros.
What an attacker gains
MITRE lists the consequence as non-repudiation, specifically hiding activities. The user performed the action, and nothing in the interface made the risk visible. The attacker needs only to persuade someone to open the thing.
How to find it
No detection methods are listed. Walk through your product as an attacker's target would.
- Which features execute or import content that came from outside?
- Is there any moment where the user is told what is about to happen?
- Does the interface mark content from untrusted origins differently from local content?
How to fix it
The record offers no mitigation list, so these steps come from the definition.
- Identify actions that run code, change settings or send data on the user's behalf.
- Put a clear warning before those actions, in plain language that names the consequence.
- Default to the safe option, and make the risky choice take a deliberate step.
- Mark content from untrusted sources so the warning has something to key on.
Quick check
Which kind of content does MITRE point to in its observed examples?
Documents containing dangerous functions or macros, where the product opened them without telling the user.
Sources
- MITRE CWE-356: https://cwe.mitre.org/data/definitions/356.html
