CWE-940, Improper Verification of Source of a Communication Channel, applies when a product opens a channel to handle an incoming request but does not verify the request comes from the expected origin. It spans desktop apps, mobile apps and network services.
How it happens
Something starts a conversation with your software and your software answers without asking who is on the other end. If an attacker establishes a channel from an untrusted origin, they may gain privileges and reach functionality that was only meant for a trusted source.
The observed examples include both old and recent cases:
- CVE-2025-3651 (details): a desktop product did not properly verify the source of a communication channel, allowing command execution.
- CVE-2000-1218 and CVE-2005-0877: DNS servers accepted updates from hosts they never queried, leading to cache poisoning.
- CVE-2001-1452: a DNS server cached glue records received from non-delegated name servers.
The DNS cases show the idea well. The server should only accept an answer from the party it asked.
What an attacker gains
MITRE says an attacker can access any functionality that is inadvertently accessible to the source. Impact includes gaining privileges and bypassing protection mechanisms, and it varies by context.
How to find it
The record lists no detection methods. Map every entry point that accepts requests: local sockets, named pipes, custom URL handlers, web sockets, message queues, and DNS or other network replies. For each, write down what ties the request to an expected origin. If the answer is nothing, that is the finding.
How to fix it
From the MITRE mitigations:
- Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data so it cannot be modified in transit by an adversary in the middle.
- When designing URL scheme actions, consider whether an action should be open to all mobile applications, or whether an allowlist of applications is appropriate.
Also bind local services to loopback where they only serve the local machine, and match replies to the requests you made.
Quick check
What did the DNS examples get wrong?
They accepted updates from hosts they did not query, so any sender could poison the cache.
