CWE-669 covers the moment a resource or behavior moves from one control sphere to another and the move is handled badly. Either the product fails to transfer something properly, or it imports something from another sphere in a way that gives unintended control over it. Anything that accepts uploads, downloads updates, pulls dependencies or exports files crosses spheres, so this reaches almost every product.
How it happens
A sphere is the set of actors who are meant to control a resource. Data coming in from outside is outside your sphere until you verify it. Data going out should carry only what you intend to share. The weakness appears when either direction is trusted by default.
The record lists three examples that show different faces of it.
Importing without verification. CVE-2021-22909 is a chain in which a router's firmware update procedure uses curl with the insecure option that disables certificate validation (CWE-295). That allows an adversary-in-the-middle to compromise the device with a malicious firmware image. The firmware crossed from the internet into the device, and nothing confirmed who sent it.
Importing the wrong kind of thing. CVE-2023-5227 is a PHP-based FAQ management application that does not check the MIME type for uploaded images.
Exporting more than intended. CVE-2005-0406 describes image editors that modify a JPEG but leave the original EXIF thumbnail intact inside the file. The record notes it is also an interaction error. The edited image leaves the user's sphere carrying data the user thought was gone.
A vulnerable pattern for the update case:
# Vulnerable: certificate validation disabled, no integrity check on the file
curl -k -o update.bin https://updates.example.com/latest.bin
./install update.bin
# Safer: validate TLS, then verify a signature or checksum before use
curl -fsSL -o update.bin https://updates.example.com/latest.bin
curl -fsSL -o update.bin.sig https://updates.example.com/latest.bin.sig
verify_signature update.bin update.bin.sig trusted_public_key.pem && ./install update.bin
Here verify_signature stands for whichever signature verification tool your platform uses. The point is that the check happens before the file is trusted.
What an attacker gains
MITRE lists impact on confidentiality and integrity: reading application data, modifying application data and causing an unexpected state. In the firmware case the attacker gains control of the device. In the upload case, they may place content the application should have refused. In the thumbnail case, a viewer gains data the owner meant to remove.
How to find it
The record lists no detection methods. Map every boundary where something enters or leaves your product and ask what is checked at each crossing.
- List inputs: uploads, downloaded updates, plugins, packages, imported files, webhooks.
- For each, check that the origin is authenticated and the content is validated or signed.
- Search code and scripts for disabled certificate validation flags and for uploads accepted on file extension alone.
- List outputs: exports, logs, generated documents, images. Check for leftover metadata and hidden fields.
- For build and release pipelines, check that the artifacts you consume are verified and that the ones you publish carry provenance.
How to fix it
MITRE lists no formal mitigations on this entry. Practical steps follow from its description.
- Authenticate the source of everything you import, using validated TLS at minimum.
- Verify integrity with signatures or checksums from a trusted channel before using an imported artifact.
- Validate the real content type of uploads by inspecting the content, not by trusting the declared type or file name.
- Strip metadata and hidden data from anything you export.
- Treat the transfer step as a security decision with its own review, logging and tests.
For software you ship or consume, signed provenance records make step 2 routine. The demo below shows how attestation data can travel with an artifact. For your dependencies, the free Gold dependency scan runs in the browser with no login, keeps the file on your machine, and checks up to 100 dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is curl with certificate checks disabled a problem for updates?
Anyone positioned between the device and the server can substitute a malicious file, and the device cannot tell. The router example in the record ended in adversary-in-the-middle compromise.
Is checking the MIME type declared by the browser enough?
No. The declared type is supplied by the sender. The record's FAQ application example is a missing MIME type check on uploaded images.
Does this weakness only concern data coming in?
No. The EXIF thumbnail example shows data leaving with more content than the owner expected.
