CWE-360, Trust of System Event Data, is about security decisions based on event data. MITRE's short version: security based on event locations is insecure and can be spoofed.
It matters to anyone writing desktop software or a component that listens for messages from the operating system or other programs.
How it happens
Events are a messaging system. They give control data to programs that listen for them. MITRE points out that events often have no authentication framework, so a listener cannot verify who sent one.
The Windows example is the clearest. Any application on a given desktop can send a message to any window on the same desktop, and there is no authentication on those messages. A process that does not check the validity and safety of what it receives can be steered by any other program on that desktop.
The observed CVE is CVE-2004-0213, where an attacker used a Shatter attack to bypass GUI enforced protection for CVE-2003-0908.
What an attacker gains
MITRE lists integrity, confidentiality, availability and access control impact, including executing unauthorized code or commands. If you trust event information and run commands based on it, you may take actions on a spoofed identity.
How to find it
The record gives no detection methods. Review your event handlers.
- Which handlers make a security decision from an event's contents or origin?
- Could another process on the same desktop or system send the same event?
- Does a privileged process expose a window or channel that accepts messages from unprivileged ones?
How to fix it
MITRE's mitigation is one line, and a strong one: never trust or rely on any of the information in an event for security.
In practice, that means:
- Treat event data as untrusted input and validate it.
- Do not let a privileged component act on messages from a less privileged one without strict checks.
- Enforce security through a channel that authenticates the caller, not through event positions or names.
Quick check
What makes Windows messages risky as a trust source?
Any application on a desktop can send a message to any window on that desktop, and the messages carry no authentication.
Sources
- MITRE CWE-360: https://cwe.mitre.org/data/definitions/360.html
