CWE-347: Improper Verification of Cryptographic Signature

Code Examples & CVEs

Demonstrative Examples

In the following code, a JarFile object is created from a downloaded file.

The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.

BadJava

File f = new File(downloadedFilePath);JarFile jf = new JarFile(f);

Observed CVE Examples (4)

CVE-2002-1796

Does not properly verify signatures for "trusted" entities.

View Details

CVE-2005-2181

Insufficient verification allows spoofing.

View Details

CVE-2005-2182

Insufficient verification allows spoofing.

View Details

CVE-2002-1706

Accepts a configuration file without a Message Integrity Check (MIC) signature.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Detect Improper Verification of Cryptographic Signature with Automated Static Analysis

Documented detection approaches include Automated Static Analysis; recorded impacts include Gain Privileges or Assume Identity, Modify Application Data, and Execute Unauthorized Code or Commands; the entry maps to CAPEC-463, and CAPEC-475. Use these source-defined anchors to turn CWE-347 into implementation, review, and verification checks for the affected component.

CWE-347: Improper Verification of Cryptographic Signature — MITRE CWE

Verify signatures over the exact canonical message and trust context

Use maintained signature-verification libraries, pin acceptable algorithms and trust anchors, and verify the signature before consuming identity or authorization claims. Bind verification to the exact canonical message, issuer, audience, destination, and replay state. Reject unsigned content, duplicate or wrapping elements, algorithm substitution, ambiguous key selection, and any verification error.

SAML Security Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2020-1464 in Microsoft Windows

NVD maps CVE-2020-1464 to CWE-347; incorrect validation of file signatures allowed attackers to bypass security features and load improperly signed files. Use the case to test malformed and substituted signed content, enforce one canonical verification path before loading, and confirm trust decisions cannot fall back to weaker or inconsistent signature parsers.

CVE-2020-1464 Detail — NIST National Vulnerability Database

Constrain digital signatures to FIPS 186-5 algorithms and validation

Use FIPS 186-5 as the algorithm and key-generation baseline where applicable, together with protocol-specific rules for encoding, trust, identity, freshness, and canonicalization. Validation must fail closed for unsupported algorithms, invalid domain parameters, malformed encodings, and untrusted keys; cryptographic correctness alone does not establish that the signed message is authorized.

FIPS 186-5 Digital Signature Standard — National Institute of Standards and Technology

Mutate signed tokens and documents at every verification boundary

Test missing and corrupted signatures, algorithm changes, none, unknown keys, stale or revoked keys, duplicate fields, claim relocation, wrapping, canonicalization differences, invalid issuer and audience, and replay. Confirm the application rejects the entire object before using any claim and that verification cannot be bypassed through a fallback parser or alternate authentication route.

Testing JSON Web Tokens — OWASP Foundation

Frequently Asked Questions

What is CWE-347: Improper Verification of Cryptographic Signature?+

CWE-347: Improper Verification of Cryptographic Signature is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not verify, or incorrectly verifies, the cryptographic signature for data.

What are the security consequences of Improper Verification of Cryptographic Signature?+

If exploited, CWE-347 (Improper Verification of Cryptographic Signature) it can compromise Access Control, Integrity and Confidentiality, leading to outcomes such as Gain Privileges or Assume Identity, Modify Application Data and Execute Unauthorized Code or Commands.

Which programming languages are affected by Improper Verification of Cryptographic Signature?+

CWE-347 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Verification of Cryptographic Signature?+

MITRE documents real CVEs mapped to CWE-347, including CVE-2002-1796, CVE-2005-2181, CVE-2005-2182 and CVE-2002-1706. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-347 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-347: Improper Verification of Cryptographic Signature

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (4)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Detect Improper Verification of Cryptographic Signature with Automated Static Analysis

Verify signatures over the exact canonical message and trust context

Apply lessons from CVE-2020-1464 in Microsoft Windows

Constrain digital signatures to FIPS 186-5 algorithms and validation

Mutate signed tokens and documents at every verification boundary

Frequently Asked Questions

Learn More