CWE-295 Improper Certificate Validation
What this means
SiteShadow flagged TLS usage where certificate validation is missing, incomplete, or overridden (accepting invalid certs, skipping hostname checks, trusting any certificate).
Why it matters
Improper validation can enable interception or tampering.
- Man-in-the-middle attacks: attackers can intercept and modify traffic.
- Credential/token theft: session cookies and API keys can leak.
- Often shipped as a "temporary dev fix" that accidentally reaches production.
Safer examples
1) Keep verification enabled by default
Avoid disabling verification flags; rely on defaults unless you have a controlled reason.
2) Fix trust store/CA issues properly
- Install the correct CA bundle on the host/container.
- Use proper hostnames that match certificates.
3) If you need custom trust, scope it tightly
Pin only the required internal CA(s) and never turn verification off globally (see CERT01 / T01).
How SiteShadow detects it (high level)
- Flags known "skip verification" settings and incomplete validation patterns across common HTTP/TLS clients.
- Treats this as high severity outside explicit dev/test-only contexts.
References
- CWE-295: https://cwe.mitre.org/data/definitions/295.html
---