CWE-357 Insufficient UI Warning of Dangerous Operations

CWE-357, Insufficient UI Warning of Dangerous Operations, is a close cousin of its neighbor CWE-356. Here the interface does warn the user about a dangerous or sensitive operation. The warning is just not noticeable enough to earn attention.

Any product that shows security dialogs, banners or prompts can fall into it.

How it happens

A team adds a warning to satisfy a requirement. It is small, grey, worded like a legal notice, or buried among other messages. People learn to click through. The warning exists on paper and fails in practice.

MITRE's observed example is CVE-2007-1099: a user was not sufficiently warned when a host key mismatch occurred. A host key mismatch is exactly the signal that someone might be sitting in the middle of the connection. A weak notice there defeats the check.

What an attacker gains

The record lists non-repudiation and hiding activities. The attacker's trick works because the user sees the warning and does not register it, or never sees it at all, and the user is the one who proceeds.

How to find it

The record has no detection methods. Test the warning with real people if you can, and review it yourself.

• Is the warning visible without scrolling or hunting?
• Does it say what will happen if the user continues?
• Is the safe choice the default, and does continuing require a distinct action?
• Does the same dialog appear so often that people stop reading?

How to fix it

No mitigations are listed for this entry, so these steps are practice from the definition.

1. Reserve prominent warnings for events that really matter, so they keep their weight.
2. State the specific danger in plain words, not a generic caution.
3. Make the safe option the easy one.
4. For signals like a changed host key, stop the operation and require an explicit, informed override.

Quick check

Sources

• MITRE CWE-357: https://cwe.mitre.org/data/definitions/357.html