CWE-451 User Interface Misrepresentation

Coverage: 5 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 5 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged UI behavior or messaging that can mislead users about what is actually happening (security state, identity, authorization, privacy, or where data is going). This includes "looks successful but failed", "looks private but isn't", or "looks like you're logged out but session remains".

Why it matters

Misleading UI can cause users to make unsafe decisions.

• Accidental sensitive actions: users approve, delete, or share data based on incorrect cues.
• Security bypass by confusion: users think a control is active (MFA, encryption, logout) when it's not.
• Phishing-like impact inside your app: attackers exploit UI ambiguity to trick users.

Safer examples

1) Make security state explicit and server-confirmed

Don't show "Saved" or "2FA enabled" until the server confirms success.

2) Use clear, consistent labels for sensitive actions

Avoid vague buttons like "OK" for destructive actions; use "Delete account", "Transfer $X", etc.

3) Close the loop on logout/permission changes

After logout, invalidate server-side sessions/tokens and verify the user is actually unauthenticated (see CWE-613 / CWE-287).

How SiteShadow detects it (high level)

• Flags mismatches where UI indicates a security property but the underlying server behavior doesn't enforce it.
• Detects risky UI patterns around auth/session state, data sharing, and security settings.

References

• CWE-451: https://cwe.mitre.org/data/definitions/451.html

---

← Back to Vulnerability Library