CWE-421 is a product that opens an alternate channel to talk to an authorized user, but leaves that channel reachable by other actors. This creates a race: whoever connects first wins.
How it happens
A service opens a second port or pipe, tells the user where it is, and waits. Between opening and the legitimate connection, an attacker connects to it.
MITRE lists two examples. In the FTP "Pizza Thief" issue, an attacker could connect to a port intended for another client (CVE-1999-0351). In another product, a Windows named pipe created during authentication could be hijacked by an attacker connecting to it (CVE-2003-0230).
What an attacker gains
Per the record: gaining privileges or assuming identity, and bypassing protection mechanisms.
How to find it
The record has no detection methods. Check manually:
- Find every place the code opens a listener, pipe or port for a specific peer.
- Ask whether the channel verifies that the connecting party is the expected one.
How to fix it
- Authenticate the peer on the alternate channel, not only the first one.
- Restrict who can connect, for example with pipe access controls or a source address check.
- Use unpredictable names and tokens for the channel, and accept only one connection.
- Prefer a single channel when you can.
Why the window is short but real
The gap between opening a channel and the right user connecting may be milliseconds. Attackers do not need to be precise. They can poll for the port or pipe, or connect in a loop, and win the race some of the time. Predictable names and port numbers make this easy. Random, single use identifiers and an authentication step on the second channel remove the advantage.
Quick check
What makes this a race?
The channel exists before its intended user arrives. Anyone who connects in that window can take it.
