COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-633

Token Impersonation

An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

Abstraction

Detailed

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

Requirements

What does the attack require?

Prerequisites

  • This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Alter Execution Logic

Affected scopes: Integrity

Gain Privileges

Affected scopes: Integrity

Hide Activities

Affected scopes: Integrity

CAPEC-633: Token Impersonation — DayBreach Saldırı Sözlüğü · DayBreach