CWE-295 Improper Certificate Validation

Coverage: 20 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 15Other-pattern 5 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged TLS usage where certificate validation is missing, incomplete, or overridden (accepting invalid certs, skipping hostname checks, trusting any certificate).

Why it matters

Improper validation can enable interception or tampering.

• Man-in-the-middle attacks: attackers can intercept and modify traffic.
• Credential/token theft: session cookies and API keys can leak.
• Often shipped as a "temporary dev fix" that accidentally reaches production.

Safer examples

1) Keep verification enabled by default

Avoid disabling verification flags; rely on defaults unless you have a controlled reason.

2) Fix trust store/CA issues properly

• Install the correct CA bundle on the host/container.
• Use proper hostnames that match certificates.

3) If you need custom trust, scope it tightly

Pin only the required internal CA(s) and never turn verification off globally (see CERT01 / T01).

How SiteShadow detects it (high level)

• Flags known "skip verification" settings and incomplete validation patterns across common HTTP/TLS clients.
• Treats this as high severity outside explicit dev/test-only contexts.

References

• CWE-295: https://cwe.mitre.org/data/definitions/295.html

---

← Back to Vulnerability Library