CWE-451 is about interfaces that fail to show the truth. The UI does not properly represent critical information, so the information, or its source, can be obscured or spoofed. MITRE notes this is often a component in phishing attacks.
It affects anything that asks a human to make a security decision from what is on screen: permission dialogs, file pickers, mail clients, browsers and monitoring consoles.
How it happens
MITRE describes several forms:
- Incorrect indicator: wrong information is shown, so the user cannot understand the real state, especially of a dangerous condition.
- Overlay: an area meant to show critical information can be covered by another element, so the user is not interacting with what they think. This is what enables clickjacking.
- Icon manipulation: the wrong icon or colour is shown, such as making a dangerous executable look like a harmless image.
- Timing: a state change or context switch is presented with an indicator that no longer matches.
Observed examples:
- CVE-2024-27936: a JavaScript application removed ANSI escape sequences in a dialog asking permission for a file, so the wrong filename was shown for approval.
- CVE-2004-2227: a browser's filename selection dialog showed only the beginning of long filenames, which could trick users into launching executables with dangerous extensions.
- CVE-2001-0398: an attachment with many spaces in its filename bypassed a dangerous content warning and used a different icon.
What an attacker gains
From the record: they can hide activity, bypass protection mechanisms, gain access they should not have, and avoid attribution. If the UI is a monitoring tool, hiding an indicator can stop an operator from noticing a security event.
How to find it
The record lists no detection methods. Review every dialog that asks for a decision and try to make it lie. Feed it very long names, trailing spaces, control characters, escape sequences and look-alike characters. Check that the part the user sees is the part that matters.
How to fix it
MITRE's mitigations:
- Perform data validation, such as syntax and length, before interpreting the data.
- Plan a strategy for presenting information, including how to display unusual characters.
In practice, show the full value or the end of long names, make control characters visible, and never strip characters in a way that changes what is being approved. The JavaScript case is the cautionary tale: sanitizing the display text changed what the user was approving.
Quick check
How can a long filename be dangerous?
If a dialog shows only the beginning, the dangerous extension at the end stays hidden, and the user may launch an executable thinking it is harmless.
