What is Missing Check for Certificate Revocation (CWE-370)?

TL;DR: Missing Check for Certificate Revocation after Initial Check (CWE-370) is a security vulnerability where systems fail to re-check certificate revocation, leading to potential unauthorized access and data disclosure.

What is Missing Check for Certificate Revocation after Initial Check?

Missing Check for Certificate Revocation after Initial Check (CWE-370) is a type of security vulnerability where the product does not re-check the revocation status of a certificate after its initial check. This can cause the product to perform privileged actions even after the certificate has been revoked at a later time.

As defined by the MITRE Corporation under CWE-370, and classified by the OWASP Foundation under no direct mapping, this vulnerability poses significant risks in systems that rely on secure communication channels.

Quick Summary

Missing Check for Certificate Revocation after Initial Check is critical because it allows attackers to exploit revoked certificates, leading to unauthorized access and data disclosure. This issue affects SSL/TLS and PKI systems where continuous certificate validation is essential but often overlooked. Understanding the root cause and implementing robust checks can prevent such vulnerabilities.

Jump to: Quick Summary · Missing Check for Certificate Revocation after Initial Check Overview · How Missing Check for Certificate Revocation after Initial Check Works · Business Impact of Missing Check for Certificate Revocation after Initial Check · Missing Check for Certificate Revocation after Initial Check Attack Scenario · How to Detect Missing Check for Certificate Revocation after Initial Check · How to Fix Missing Check for Certificate Revocation after Initial Check · Framework-Specific Fixes for Missing Check for Certificate Revocation after Initial Check · How to Ask AI to Check Your Code for Missing Check for Certificate Revocation after Initial Check · Missing Check for Certificate Revocation after Initial Check Best Practices Checklist · Missing Check for Certificate Revocation after Initial Check FAQ · Vulnerabilities Related to Missing Check for Certificate Revocation after Initial Check · References · Scan Your Own Site

Missing Check for Certificate Revocation after Initial Check Overview

What: The product does not re-check the revocation status of a certificate after its initial check.

Why it matters: This can lead to unauthorized access and data disclosure if an attacker exploits revoked certificates.

Where it occurs: SSL/TLS and PKI systems that do not implement continuous checks for certificate revocation.

Who is affected: Applications and services using SSL/TLS or relying on secure communication channels without re-validation of certificate status.

Who is NOT affected: Systems already enforcing continuous validation of certificate revocation status before each use of a protected resource.

How Missing Check for Certificate Revocation after Initial Check Works

Root Cause

The root cause lies in the failure to implement continuous checks for certificate revocation, allowing revoked certificates to remain trusted and continue performing privileged actions.

Attack Flow

1. An attacker obtains or compromises a valid but soon-to-be-revoked certificate.
2. The system performs an initial check and grants access based on this certificate.
3. The certificate is then revoked by the issuing authority.
4. The system does not re-check the revocation status before subsequent uses, allowing the attacker to exploit the revoked certificate.

Prerequisites to Exploit

• Initial validation of a valid but soon-to-be-revoked certificate.
• No continuous checks for certificate revocation after initial validation.

Vulnerable Code

def validate_certificate(cert):
    # Perform initial check and grant access based on cert status
    if is_valid_cert(cert):
        return True

This code does not re-check the revocation status of cert before each use, making it vulnerable to exploitation by revoked certificates.

Secure Code

def validate_certificate(cert):
    # Perform initial check and grant access based on cert status
    if is_valid_cert(cert) and is_not_revoked(cert):
        return True

The secure version ensures that the certificate is re-checked for revocation status before each use, mitigating the risk of exploiting revoked certificates.

Business Impact of Missing Check for Certificate Revocation after Initial Check

Confidentiality

Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.

Integrity

Data from untrusted sources can be integrated, leading to unauthorized modifications and data tampering.

• Financial losses due to unauthorized access.
• Compliance issues with regulatory requirements for secure communication.
• Damage to reputation if sensitive data is compromised.

Missing Check for Certificate Revocation after Initial Check Attack Scenario

1. An attacker obtains a valid but soon-to-be-revoked certificate from the issuing authority.
2. The system performs an initial validation and grants access based on this certificate.
3. The certificate is revoked by the issuing authority.
4. The attacker exploits the system’s failure to re-check revocation status, gaining unauthorized access.

How to Detect Missing Check for Certificate Revocation after Initial Check

Manual Testing

• Verify that certificates are checked for revoked status before each use of a protected resource.
• Ensure continuous validation mechanisms are in place and functioning correctly.

Automated Scanners (SAST / DAST)

Static analysis can detect instances where certificate validation logic is missing re-checks. Dynamic testing requires runtime observation to confirm the absence of revocation checks after initial validation.

PenScan Detection

PenScan’s SSLyze engine detects instances where continuous validation of certificate revocation status is not enforced.

False Positive Guidance

A false positive may occur if a system has implemented proper re-validation mechanisms but these are not detected by static analysis tools. Manual verification confirms the presence or absence of such checks.

How to Fix Missing Check for Certificate Revocation after Initial Check

• Ensure that certificates are checked for revoked status before each use of a protected resource.
• Implement continuous validation mechanisms to mitigate risks associated with revoked certificates.

Framework-Specific Fixes for Missing Check for Certificate Revocation after Initial Check

Python/Django

def validate_certificate(cert):
    if is_valid_cert(cert) and is_not_revoked(cert):
        return True

Java

public boolean validateCertificate(Certificate cert) {
    if (isCertValid(cert) && !cert.isRevoked()) {
        return true;
    }
}

How to Ask AI to Check Your Code for Missing Check for Certificate Revocation after Initial Check

Missing Check for Certificate Revocation after Initial Check Best Practices Checklist

• Ensure certificates are checked for revoked status before each use of a protected resource.
• Implement continuous validation mechanisms to mitigate risks associated with revoked certificates.

Missing Check for Certificate Revocation after Initial Check FAQ

How does Missing Check for Certificate Revocation after Initial Check work?

It occurs when a system fails to re-check the revocation status of a certificate before each use, allowing an attacker to exploit revoked certificates.

What are the consequences of Missing Check for Certificate Revocation after Initial Check?

Trust may be assigned to entities who are not who they claim to be, leading to unauthorized access and data disclosure.

How can I detect Missing Check for Certificate Revocation after Initial Check in my code?

Use static analysis tools that check certificate validation logic and re-check revocation status before each use of a protected resource.

What is the root cause of Missing Check for Certificate Revocation after Initial Check?

The root cause lies in the failure to implement continuous checks for certificate revocation, allowing revoked certificates to remain trusted.

How can I prevent Missing Check for Certificate Revocation after Initial Check in my application?

Ensure that certificates are checked for revoked status before each use of a protected resource to mitigate this vulnerability.

What is the impact of Missing Check for Certificate Revocation after Initial Check on system integrity?

It can lead to unauthorized modifications and data tampering by exploiting revoked certificates.

How does PenScan detect Missing Check for Certificate Revocation after Initial Check?

PenScan uses SSLyze to scan for certificate revocation checks and flags any instances where continuous validation is missing.

Vulnerabilities Related to Missing Check for Certificate Revocation after Initial Check

References

• MITRE - CWE-370
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Missing Check for Certificate Revocation after Initial Check and other risks before an attacker does.