Insufficient UI Warning of Dangerous Operations

Description

Insufficient UI Warning of Dangerous Operations is a vulnerability that occurs when an application's user interface provides a warning about dangerous or sensitive operations, but the warning is not noticeable, prominent, or clear enough to effectively capture user attention and convey the actual risk. Unlike CWE-356 where warnings are completely absent, this weakness involves warnings that exist but are ineffective—they may be too subtle, poorly worded, easily dismissed without reading, visually similar to routine prompts, buried in lengthy text, or displayed in locations users habitually ignore. The result is that users proceed with dangerous actions without understanding the risks, believing they have been adequately informed when they have not. This includes scenarios such as SSH host key mismatch warnings that users routinely dismiss, certificate warnings that blend in with normal browser UI, and permission dialogs that fail to convey the scope of access being granted.

Risk

Insufficient warnings create a dangerous false sense of security while providing minimal actual protection. Research shows that browser users ignore up to 70% of security alerts due to warning fatigue, and studies found that only 49.2% of users correctly understood SSL certificate warnings—equivalent to random guessing. When users become desensitized to security prompts, they develop habitual dismissal patterns that attackers exploit. MFA fatigue attacks, which bombard users with authentication prompts until they approve one out of frustration, have successfully compromised major organizations including Cisco, Uber, and Microsoft. The 2025 Unit 42 Global Incident Response Report found that 13% of social engineering incidents were traced to ignored or untriaged security alerts. Users who click through certificate warnings internalize that ignoring security prompts is acceptable behavior, making them vulnerable to man-in-the-middle attacks and credential theft. Every time users are trained by legitimate applications to dismiss warnings, malicious actors gain an advantage. Even security experts fall victim—Troy Hunt, founder of Have I Been Pwned, had his Mailchimp account compromised through a phishing attack when tired and rushed.

Solution

Design warnings to be proportional to the risk involved, with critical security warnings requiring explicit user action beyond simply clicking "OK" or "Continue." Use visual distinctiveness through color, icons, size, and positioning to clearly differentiate security warnings from routine dialogs. For high-risk or irreversible actions, require users to type confirmation text rather than just clicking buttons. Implement number matching for MFA prompts, where users must enter a specific number displayed on the login screen to approve authentication requests, preventing automatic approval. Reduce overall warning frequency to combat warning fatigue—every unnecessary prompt trains users to dismiss alerts without reading them. Use progressive disclosure to show additional details only when relevant. Test warning effectiveness with actual users through usability studies. Consider phishing-resistant authenticators like FIDO2 security keys that require physical interaction. For certificate warnings, provide clear, actionable guidance rather than technical jargon. Implement rate limiting on security prompts to prevent fatigue attacks, and log when users dismiss security warnings for security monitoring purposes.

Common Consequences

Impact	Details
Non-Repudiation	Scope: Non-Repudiation Hide Activities - Users may not recognize warnings about risky operations, enabling undetected unauthorized actions. When warnings are insufficient, organizations cannot demonstrate that users were meaningfully informed of risks, creating liability issues and eliminating audit trail value.
Access Control	Scope: Access Control Gain Privileges or Assume Identity - Subtle warnings about authentication issues enable MFA fatigue attacks where users eventually approve malicious access requests. Ineffective certificate warnings allow man-in-the-middle attackers to intercept credentials.
Confidentiality	Scope: Confidentiality Read Application Data - When users dismiss certificate or connection warnings due to their subtle presentation, attackers can eavesdrop on encrypted communications, stealing sensitive data including passwords, financial information, and personal data.

Example Code

Vulnerable Code

// VULNERABLE: Warning is too subtle and easily dismissed
function vulnerableSecurityPrompt(message) {
    // VULNERABLE: Generic, non-descriptive dialog
    // Blends in with routine application prompts
    if (confirm(message)) {  // Just "OK" / "Cancel"
        return true;
    }
    return false;
}

// VULNERABLE: SSL certificate warning that users ignore
function vulnerableCertificateWarning(certError) {
    // VULNERABLE: Technical jargon users don't understand
    // No visual distinction from normal dialogs
    // Easy "proceed anyway" option
    const message = `Certificate error: ${certError.code}
                     Do you want to continue?`;

    // VULNERABLE: Simple yes/no that users click through
    return confirm(message);
}

// VULNERABLE: SSH host key warning that's routinely dismissed
function vulnerableHostKeyWarning(hostname, oldKey, newKey) {
    // VULNERABLE: Wall of text users don't read
    console.warn(`
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    @    WARNING: REMOTE HOST IDENTIFICATION CHANGED!
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
    `);

    // VULNERABLE: After showing scary text, still allows bypass
    return promptYesNo("Do you want to continue connecting?");
}

// VULNERABLE: Permission dialog that doesn't convey scope
function vulnerablePermissionRequest(permissions) {
    // VULNERABLE: Vague description of access being granted
    return confirm(`Allow this app to access your data?`);
    // User doesn't understand "data" means contacts, photos, location, etc.
}

Fixed Code

// FIXED: Prominent, contextual security warning
async function secureSecurityPrompt(riskLevel, context) {
    const dialog = document.createElement('div');
    dialog.className = `security-dialog risk-${riskLevel}`;

    // FIXED: Visual distinction based on risk level
    const colors = {
        critical: '#d32f2f',  // Red for critical risks
        high: '#f57c00',      // Orange for high risks
        medium: '#fbc02d'     // Yellow for medium risks
    };

    dialog.style.borderColor = colors[riskLevel];

    // FIXED: Clear, specific warning with actionable information
    dialog.innerHTML = `
        <div class="warning-header" style="background: ${colors[riskLevel]}">
            <span class="warning-icon">⚠️</span>
            <h2>Security Warning</h2>
        </div>
        <div class="warning-content">
            <p class="warning-summary">${context.summary}</p>
            <details>
                <summary>Technical details</summary>
                <p>${context.technicalDetails}</p>
            </details>
            <p class="warning-consequence">
                <strong>Risk:</strong> ${context.potentialConsequence}
            </p>
        </div>
        <div class="warning-actions">
            <button class="btn-safe" id="cancel">Go back to safety</button>
            <button class="btn-danger" id="proceed" disabled>
                I understand the risk
            </button>
        </div>
    `;

    // FIXED: Require delay before allowing dangerous action
    const proceedBtn = dialog.querySelector('#proceed');
    setTimeout(() => {
        proceedBtn.disabled = false;
    }, 3000);  // 3 second delay forces user to wait and read

    return new Promise(resolve => {
        dialog.querySelector('#cancel').onclick = () => resolve(false);
        dialog.querySelector('#proceed').onclick = () => resolve(true);
        document.body.appendChild(dialog);
    });
}

// FIXED: Certificate warning with clear explanation
async function secureCertificateWarning(certError, siteInfo) {
    // FIXED: Plain language explanation of the risk
    const explanations = {
        'CERT_EXPIRED': 'This website\'s security certificate has expired. ' +
                        'Your connection may not be private.',
        'CERT_UNTRUSTED': 'This website\'s identity cannot be verified. ' +
                          'An attacker may be intercepting your connection.',
        'CERT_MISMATCH': `This certificate is for a different website. ` +
                         `You may be connecting to an imposter site.`
    };

    return secureSecurityPrompt('critical', {
        summary: explanations[certError.code] ||
                 'There is a problem with this website\'s security.',
        technicalDetails: `Certificate: ${certError.details}`,
        potentialConsequence: 'If you proceed, attackers may be able to ' +
                              'steal your passwords, messages, or credit cards.'
    });
}

// FIXED: MFA prompt with number matching to prevent fatigue attacks
function secureMFAPrompt(loginContext) {
    // FIXED: Generate random number for verification
    const verificationNumber = Math.floor(Math.random() * 100);

    const dialog = createSecureDialog({
        title: 'Verify Your Identity',
        content: `
            <p>A sign-in attempt requires your approval.</p>
            <div class="verification-info">
                <p><strong>Location:</strong> ${loginContext.location}</p>
                <p><strong>Device:</strong> ${loginContext.device}</p>
                <p><strong>Time:</strong> ${loginContext.timestamp}</p>
            </div>
            <div class="number-match">
                <p>Enter this number in your authenticator app:</p>
                <span class="verification-number">${verificationNumber}</span>
            </div>
            <p class="warning-text">
                If you did not initiate this sign-in, tap Deny and
                change your password immediately.
            </p>
        `,
        requireNumberMatch: verificationNumber  // FIXED: Prevents auto-approve
    });

    return dialog.show();
}

// FIXED: Permission dialog with specific scope information
async function securePermissionRequest(permissions) {
    // FIXED: List each permission with clear explanation
    const permissionDetails = permissions.map(p => `
        <li class="permission-item">
            <span class="permission-icon">${p.icon}</span>
            <div>
                <strong>${p.name}</strong>
                <p class="permission-desc">${p.description}</p>
                <p class="permission-example">Example: ${p.usageExample}</p>
            </div>
        </li>
    `).join('');

    return secureSecurityPrompt('high', {
        summary: 'This app is requesting access to sensitive information:',
        technicalDetails: `<ul class="permission-list">${permissionDetails}</ul>`,
        potentialConsequence: 'The app will be able to access this data ' +
                              'even when you\'re not using it.'
    });
}

The vulnerable code shows common patterns where warnings exist but fail to effectively communicate risk—generic confirm dialogs, technical jargon, walls of text, and easy bypass options. The fixed code implements visually distinct warnings with plain language explanations, forced delays to ensure users read the content, number matching for MFA to prevent fatigue attacks, and specific permission scopes so users understand what access they're granting.

Exploited in the Wild

MFA Fatigue Attack on Cisco (Cisco Systems, 2022)

Attackers successfully compromised Cisco's internal network by exploiting MFA fatigue combined with social engineering. After obtaining employee credentials, attackers bombarded the target with repeated MFA push notifications while simultaneously calling them and pretending to be IT support. The victim, overwhelmed by notifications and deceived by the voice phishing, eventually approved an MFA prompt. This granted attackers access to Cisco's VPN network, where they escalated privileges, created backdoors, and gained deep access to internal servers. The insufficient prominence of MFA warnings—appearing as routine push notifications—failed to convey the severity of approving an unexpected request.

Lapsus$ MFA Fatigue Attack on Microsoft (Microsoft, 2022)

The hacking group Lapsus$ breached Microsoft using MFA fatigue tactics as part of their attack chain. By bombarding targeted employees with authentication requests, they eventually obtained approval to access internal systems. Once inside, Lapsus$ accessed employee accounts, high-privilege administrative accounts, and source code repositories including the Azure DevOps server. They subsequently released a cache of stolen Microsoft source code. Microsoft acknowledged the breach and confirmed MFA fatigue was part of the attack methodology. The routine appearance of MFA prompts as normal notifications contributed to employees eventually approving the malicious requests.

Tools to test/exploit

Evilginx2 — Advanced phishing framework that can capture MFA tokens by acting as a man-in-the-middle, useful for testing whether users recognize insufficient warning signs during authentication.
Gophish — Open-source phishing framework for testing user awareness of security warnings and measuring click-through rates on simulated attacks.
MFASweep — Tool for testing MFA configurations and identifying weaknesses in multi-factor authentication implementations.

CVE Examples

CVE-2007-1099 — SSH client failed to provide adequate warning when encountering host key mismatches, reducing user awareness of potential man-in-the-middle attacks.
CVE-2019-1388 — Windows UAC privilege escalation where insufficient warning visibility allowed attackers to bypass user awareness of elevated privilege requests.
CVE-2021-30883 — iOS permission dialog vulnerability where insufficient context in warnings allowed apps to obtain sensitive permissions without adequate user understanding.

References

MITRE Corporation. "CWE-357: Insufficient UI Warning of Dangerous Operations." https://cwe.mitre.org/data/definitions/357.html
WeLiveSecurity. "Warning fatigue means browser users ignore up to 70% of security alerts." July 2013. https://www.welivesecurity.com/2013/07/15/warning-fatigue-means-browser-users-ignore-up-to-70-of-security-alerts/
Slate. "SSL warnings: Users ignore them. Can we fix that?" February 2015. https://slate.com/technology/2015/02/ssl-warnings-users-ignore-them-can-we-fix-that.html
Unit 42 Palo Alto Networks. "2025 Global Incident Response Report." https://www.paloaltonetworks.com/resources/research/unit42-incident-response-report