CVE-2023-3654

Requires unique identification of the service before communications, addressing failures to validate the origin of the interaction.

Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components.

Enforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms.

Enforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources.

Mandates origin validation so that only legitimate endpoints can continue the authenticated session.

Network security controls enforce origin validation at network boundaries.

Security of network services includes validating the authenticity of service endpoints.

A.8.26 requires identifying and specifying requirements for resilience against malicious attacks including SQL injections and input validation (items d, j), plus related protections (authentication, segregation, cryptography per 8.24), which can address some but not most origin validation scenarios such as those involving untrusted cross-origin requests or implicit trust in sources.

A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).

Secure coding practices include implementing proper origin validation to prevent spoofing.