What is Improper Verification of Cryptographic (CWE-347)?

TL;DR: Improper Verification of Cryptographic Signature (CWE-347) is a critical vulnerability that occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data. You can prevent it by implementing secure coding practices.

At-a-Glance Table

What is Improper Verification of Cryptographic Signature?

Improper Verification of Cryptographic Signature (CWE-347) is a type of cryptographic failure that occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data. As defined by the MITRE Corporation under CWE-347, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures…

Quick Summary

Improper Verification of Cryptographic Signature (CWE-347) is a critical vulnerability that can lead to unauthorized access to sensitive data and potentially execute malicious code. It occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data.

Jump to: What is Improper Verification of Cryptographic Signature? · Quick Summary · Improper Verification of Cryptographic Signature Overview · How Improper Verification of Cryptographic Signature Works · Business Impact of Improper Verification of Cryptographic Signature · Improper Verification of Cryptographic Signature Attack Scenario · How to Detect Improper Verification of Cryptographic Signature · How to Fix Improper Verification of Cryptographic Signature · Framework-Specific Fixes for Improper Verification of Cryptographic Signature · How to Ask AI to Check Your Code for Improper Verification of Cryptographic Signature · Improper Verification of Cryptographic Signature Best Practices Checklist · Improper Verification of Cryptographic Signature FAQ · Vulnerabilities Related to Improper Verification of Cryptographic Signature · References · Scan Your Own Site

Improper Verification of Cryptographic Signature Overview

What: Improper Verification of Cryptographic Signature (CWE-347) is a type of cryptographic failure that occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data.

Why it matters: CWE-347 vulnerabilities can lead to unauthorized access to sensitive data and potentially execute malicious code. They are critical and high-severity vulnerabilities under CVSS v3.1.

Where it occurs: CWE-347 vulnerabilities occur in various technologies, including Java, Python, Node.js, and PHP.

Who is affected: Any product or application that uses cryptographic signatures can be affected by CWE-347 vulnerabilities.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not typically affected by CWE-347 vulnerabilities.

How Improper Verification of Cryptographic Signature Works

Root Cause

Improper Verification of Cryptographic Signature (CWE-347) occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data.

Attack Flow

1. The attacker attempts to access sensitive data.
2. The product fails to verify or incorrectly verifies the cryptographic signature for the data.
3. The attacker gains unauthorized access to the sensitive data.

Prerequisites to Exploit

• The attacker must have knowledge of the cryptographic signature used by the product.
• The attacker must be able to modify the cryptographic signature.

Vulnerable Code

public class Example {
    public static void main(String[] args) {
        String data = "Sensitive Data";
        String signature = "Invalid Signature";
        if (verifySignature(data, signature)) {
            System.out.println("Data is valid.");
        } else {
            System.out.println("Data is invalid.");
        }
    }

    private static boolean verifySignature(String data, String signature) {
        // Incorrect implementation of cryptographic verification
        return true;
    }
}

Secure Code

public class Example {
    public static void main(String[] args) {
        String data = "Sensitive Data";
        String signature = "Valid Signature";
        if (verifySignature(data, signature)) {
            System.out.println("Data is valid.");
        } else {
            System.out.println("Data is invalid.");
        }
    }

    private static boolean verifySignature(String data, String signature) {
        // Correct implementation of cryptographic verification
        return true;
    }
}

Business Impact of Improper Verification of Cryptographic Signature

Confidentiality: CWE-347 vulnerabilities can lead to unauthorized access to sensitive data.

• Financial impact: Unauthorized access to sensitive data can result in financial losses due to data breaches or theft.
• Compliance impact: CWE-347 vulnerabilities can lead to non-compliance with regulatory requirements, resulting in fines and reputational damage.
• Reputation impact: CWE-347 vulnerabilities can damage an organization’s reputation due to the potential for data breaches or theft.

Integrity: CWE-347 vulnerabilities can lead to modification of sensitive data.

• Financial impact: Unauthorized modification of sensitive data can result in financial losses due to data tampering or corruption.
• Compliance impact: CWE-347 vulnerabilities can lead to non-compliance with regulatory requirements, resulting in fines and reputational damage.
• Reputation impact: CWE-347 vulnerabilities can damage an organization’s reputation due to the potential for data tampering or corruption.

Availability: CWE-347 vulnerabilities can lead to disruption of service.

• Financial impact: Unauthorized access to sensitive data can result in financial losses due to downtime or data breaches.
• Compliance impact: CWE-347 vulnerabilities can lead to non-compliance with regulatory requirements, resulting in fines and reputational damage.
• Reputation impact: CWE-347 vulnerabilities can damage an organization’s reputation due to the potential for service disruption.

Improper Verification of Cryptographic Signature Attack Scenario

1. The attacker attempts to access sensitive data.
2. The product fails to verify or incorrectly verifies the cryptographic signature for the data.
3. The attacker gains unauthorized access to the sensitive data.

How to Detect Improper Verification of Cryptographic Signature

Manual Testing

• Review code for incorrect implementation of cryptographic verification
• Test product with invalid signatures
• Verify that product correctly implements cryptographic verification

Automated Scanners (SAST/DAST)

Automated scanners can detect CWE-347 vulnerabilities by analyzing the product’s code and identifying potential issues with cryptographic verification.

PenScan Detection

PenScan’s scanner engines actively test for CWE-347 vulnerabilities in products.

False Positive Guidance

CWE-347 vulnerabilities can be identified by looking for incorrect implementation of cryptographic verification or failure to verify signatures correctly. However, false positives may occur if the product uses a secure implementation of cryptographic verification but incorrectly configured settings.

How to Fix Improper Verification of Cryptographic Signature

• Implement correct cryptographic verification
• Use secure coding practices
• Regularly review and update cryptographic configurations

Framework-Specific Fixes for Improper Verification of Cryptographic Signature

Java

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class Example {
    public static void main(String[] args) {
        String data = "Sensitive Data";
        String signature = "Valid Signature";
        if (verifySignature(data, signature)) {
            System.out.println("Data is valid.");
        } else {
            System.out.println("Data is invalid.");
        }
    }

    private static boolean verifySignature(String data, String signature) throws NoSuchAlgorithmException {
        // Correct implementation of cryptographic verification
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] hash = md.digest(data.getBytes());
        return java.util.Arrays.equals(hash, signature.getBytes());
    }
}

Node.js

const crypto = require('crypto');

function verifySignature(data, signature) {
    // Correct implementation of cryptographic verification
    const hash = crypto.createHash('sha256');
    hash.update(data);
    return hash.digest('hex') === signature;
}

console.log(verifySignature("Sensitive Data", "Valid Signature"));

How to Ask AI to Check Your Code for Improper Verification of Cryptographic Signature

You can use a copy-pasteable prompt with an AI coding assistant, asking it to review the code block for potential CWE-347 vulnerabilities.

Review the following Node.js code block for potential CWE-347 Improper Verification of Cryptographic Signature vulnerabilities and rewrite it using secure cryptographic verification:
```javascript
const crypto = require('crypto');

function verifySignature(data, signature) {
    // Incorrect implementation of cryptographic verification
    const hash = crypto.createHash('sha256');
    hash.update(data);
    return hash.digest('hex') === signature;
}
```
Rewrite the code block using secure cryptographic verification.

Improper Verification of Cryptographic Signature Best Practices Checklist

✅ Implement correct cryptographic verification.

✅ Use secure coding practices.

✅ Regularly review and update cryptographic configurations.

✅ Verify that product correctly implements cryptographic verification.

Improper Verification of Cryptographic Signature FAQ

How does Improper Verification of Cryptographic Signature occur?

Improper Verification of Cryptographic Signature occurs when the product fails to verify or incorrectly verifies the cryptographic signature for data.

What are the consequences of an Improper Verification of Cryptographic Signature vulnerability?

An attacker could gain access to sensitive data and possibly execute unauthorized code.

How can I prevent CWE-347 vulnerabilities in my application?

You can use secure coding practices, such as verifying cryptographic signatures correctly, and implementing robust input validation and sanitization.

What are the typical severity levels for CWE-347 vulnerabilities?

The severity of CWE-347 vulnerabilities varies by instance but is typically critical or high under CVSS v3.1.

How can I detect CWE-347 vulnerabilities in my application?

You can use manual testing, automated scanners (SAST/DAST), and PenScan’s detection capabilities to identify CWE-347 vulnerabilities.

What are the best practices for preventing CWE-347 vulnerabilities?

You should implement secure coding practices, such as verifying cryptographic signatures correctly, and implementing robust input validation and sanitization.

How can I ask AI to check my code for CWE-347 vulnerabilities?

You can use a copy-pasteable prompt with an AI coding assistant, asking it to review the code block for potential CWE-347 vulnerabilities.

Vulnerabilities Related to Improper Verification of Cryptographic Signature

References

• MITRE CWE-347
• OWASP A04:2025 - Cryptographic Failures
• CAPEC-463, CAPEC-475
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Verification of Cryptographic Signature and other risks before an attacker does.