CWE-358, Improperly Implemented Security Check for Standard, describes a product that does not implement, or implements incorrectly, one or more security checks required by a standardized algorithm, protocol or technique.
If you implement a standard yourself instead of using a vetted library, this is the risk you carry.
How it happens
Standards are long. Security checks are scattered through them, sometimes in a single sentence. An implementer builds the happy path, passes interoperability tests, and ships. The missing check does not break any test because honest peers never trigger it.
MITRE's examples all share one story. In CVE-2002-0862, CVE-2002-0970 and CVE-2002-1407, browsers did not verify the Basic Constraints of a certificate, even though that verification is required. The result was spoofing of trusted certificates.
What an attacker gains
The record lists access control: bypass of a protection mechanism. When a required check is absent, the guarantee the standard promises is absent too. An attacker presents input that the check would have rejected.
How to find it
The record has no detection methods. Review against the specification.
- Read the standard's security considerations and list every "must" that involves validation.
- Map each one to a line of code. Missing lines are findings.
- Write negative tests: inputs that a correct implementation must refuse, such as a certificate that is not allowed to act as a signing authority.
How to fix it
No mitigations are listed for this entry. These steps follow from the definition.
- Prefer a maintained library for protocols and cryptography over a home grown implementation.
- If you must implement, build a checklist from the standard and trace it to code and tests.
- Test failure paths as thoroughly as success paths.
- Keep libraries updated, since fixes for missed checks arrive as version bumps. A free scan at gold.safeguard.sh/scan can show which of your dependencies have known issues. It runs in your browser, with no login, and your file stays on your machine, up to 100 dependencies.
Quick check
Why do these bugs survive interoperability testing?
Interoperability tests use well behaved peers. A missing security check only matters when the other side is hostile, so the tests never exercise it.
Sources
- MITRE CWE-358: https://cwe.mitre.org/data/definitions/358.html
