CWE-494: Download of Code Without Integrity Check

Code Examples & CVEs

Demonstrative Examples

This example loads an external class from a local subdirectory.

This code does not ensure that the class loaded is the intended one, for example by verifying the class's checksum. An attacker may be able to modify the class file to execute malicious code.

BadJava

URL[] classURLs= new URL[]{new URL("file:subdir/")};URLClassLoader loader = new URLClassLoader(classURLs);Class loadedClass = Class.forName("loadMe", true, loader);

This code includes an external script to get database credentials, then authenticates a user against the database, allowing access to the application.

This code does not verify that the external domain accessed is the intended one. An attacker may somehow cause the external domain name to resolve to an attack server, which would provide the information for a false database. The attacker may then steal the usernames and encrypted passwords from real user login attempts, or simply allow themself to access the application without a real user account.

BadPHP

//assume the password is already encrypted, avoiding CWE-312                                            function authenticate($username,$password){                         include("http://external.example.com/dbInfo.php");                                                  //dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available                         mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');mysql_select_db($dbname);$query = 'Select * from users where username='.$username.' And password='.$password;$result = mysql_query($query);                         if(mysql_numrows($result) == 1){mysql_close();return true;}else{mysql_close();return false;}                      }

Observed CVE Examples (6)

CVE-2019-9534

Satellite phone does not validate its firmware image.

View Details

CVE-2021-22909

Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494).

View Details

CVE-2008-3438

OS does not verify authenticity of its own updates.

View Details

CVE-2008-3324

online poker client does not verify authenticity of its own updates.

View Details

CVE-2001-1125

anti-virus product does not verify automatic updates for itself.

View Details

CVE-2002-0671

VOIP phone downloads applications from web sites without verifying integrity.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-494 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-494, Download of Code Without Integrity Check, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Apply Libraries or Frameworks controls for Download of Code Without Integrity Check

MITRE associates mitigation with Implementation, Architecture and Design, and Operation; the listed strategies include Libraries or Frameworks, Environment Hardening, and Sandbox or Jail; documented detection approaches include Manual Analysis, Black Box, and Automated Static Analysis. Use these source-defined anchors to turn CWE-494 into implementation, review, and verification checks for the affected component.

CWE-494: Download of Code Without Integrity Check — MITRE CWE

Triage CWE-494 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-494, Download of Code Without Integrity Check, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-494

Apply MITRE's full root-cause mapping guidance when using CWE-494, Download of Code Without Integrity Check. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-494 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-494, Download of Code Without Integrity Check. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-494: Download of Code Without Integrity Check?+

CWE-494: Download of Code Without Integrity Check is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.

What are the security consequences of Download of Code Without Integrity Check?+

If exploited, CWE-494 (Download of Code Without Integrity Check) it can compromise Integrity, Availability, Confidentiality and Other, leading to outcomes such as Execute Unauthorized Code or Commands, Alter Execution Logic and Other.

How do you prevent or mitigate Download of Code Without Integrity Check?+

Recommended mitigations for CWE-494 include: Encrypt the code with a reliable encryption scheme before transmitting. This will only be a partial solution, since it will not detect DNS spoofing and it will not prevent your code from being modified on the hosting site.

Which programming languages are affected by Download of Code Without Integrity Check?+

CWE-494 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Download of Code Without Integrity Check?+

MITRE documents real CVEs mapped to CWE-494, including CVE-2019-9534, CVE-2021-22909, CVE-2008-3438, CVE-2008-3324 and CVE-2001-1125. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-494 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-494: Download of Code Without Integrity Check

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (6)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-494 with SSDF evidence

Apply Libraries or Frameworks controls for Download of Code Without Integrity Check

Triage CWE-494 against known exploitation evidence

Apply precise root-cause mapping to CWE-494

Validate CWE-494 with root-cause mapping checks

Frequently Asked Questions

Learn More