1. Home
  2. CWE Database
  3. CWE-347
Base · Medium

CWE-347: Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

CWE-347 · Base Level ·4 CVEs

Description

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Potential Impact

Access Control, Integrity, Confidentiality

Gain Privileges or Assume Identity, Modify Application Data, Execute Unauthorized Code or Commands

Demonstrative Examples

In the following code, a JarFile object is created from a downloaded file.
Bad
File f = new File(downloadedFilePath);JarFile jf = new JarFile(f);
The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.

Detection Methods

  • Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE IDDescription
CVE-2002-1796Does not properly verify signatures for "trusted" entities.
CVE-2005-2181Insufficient verification allows spoofing.
CVE-2005-2182Insufficient verification allows spoofing.
CVE-2002-1706Accepts a configuration file without a Message Integrity Check (MIC) signature.

CWE-345: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid d...

Taxonomy Mappings

  • PLOVER: — Improperly Verified Signature
  • The CERT Oracle Secure Coding Standard for Java (2011): SEC06-J — Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar
  • ISA/IEC 62443: Part 3-3 — Req SR 1.9
  • ISA/IEC 62443: Part 4-1 — Req SM-6
  • ISA/IEC 62443: Part 4-2 — Req EDR 3.12
  • ISA/IEC 62443: Part 4-2 — Req NDR 3.12
  • ISA/IEC 62443: Part 4-2 — Req HDR 3.12

Frequently Asked Questions

What is CWE-347?

CWE-347 (Improper Verification of Cryptographic Signature) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not verify, or incorrectly verifies, the cryptographic signature for data.

How can CWE-347 be exploited?

Attackers can exploit CWE-347 (Improper Verification of Cryptographic Signature) to gain privileges or assume identity, modify application data, execute unauthorized code or commands. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-347?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-347?

CWE-347 is classified as a Base-level weakness (Medium abstraction). It has been observed in 4 real-world CVEs.