CWE-694, Use of Multiple Resources with Duplicate Identifier, applies when a product uses multiple resources that can share an identifier in a context that requires unique ones. If the code assumes uniqueness and an attacker can create duplicates, the code may operate on the wrong resource.
How it happens
MITRE's observed example is CVE-2013-4787: a mobile OS verifies the cryptographic signature of a file in an archive, but then installs a different file with the same name that is also listed in the archive.
The check and the use looked up the name separately, and the name matched two entries. One was verified, the other was installed. An illustration of the shape:
# Vulnerable: name-based lookup picks different entries each time
verify(archive.get_first(name))
install(archive.get_last(name))
The same trap exists with database keys, usernames that differ only in case or whitespace, and device or session identifiers.
What an attacker gains
MITRE says that if unique identifiers are assumed when protecting sensitive resources, duplicates may let attackers bypass the protection. In the archive example, that meant unsigned content installed as signed.
How to find it
The record lists no detection methods. Look for places where a name or ID is used to find something twice, once to check and once to act. Test by creating two items with the same identifier, including near duplicates that normalize to the same value.
How to fix it
MITRE's mitigation: where possible, use unique identifiers. If non-unique identifiers are detected, do not operate on any resource with a non-unique identifier, and report the error properly.
# Fixed: refuse ambiguity, then use the same object for check and use
entries = archive.find_all(name)
if len(entries) != 1:
raise ValueError("duplicate entry: " + name)
entry = entries[0]
verify(entry)
install(entry)
Passing the same object from verification to use, instead of looking it up twice, removes the gap.
Quick check
What should code do when it finds a duplicate identifier?
Refuse to operate on any resource with that identifier and report the error.
