CAPECattack pattern
CAPEC-633 Token Impersonation
Medium
Official page ↗
- Abstraction
- Detailed
- Status
- Stable
- Typical severity
- Medium
- CAPEC version
- 3.9
Description
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
Prerequisites
• This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity.
Consequences
• Integrity: Alter Execution Logic
• Integrity: Gain Privileges
• Integrity: Hide Activities
Related
Att&ck technique · MITRE ATT&CK (1)
- T1134 Access Token Manipulation technique
Child of · CAPEC (1)
- CAPEC-194 Fake the Source of Data attack pattern