CAPEC-196: Session Credential Falsification through Forging
Description
An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs from Reuse of Session IDs and Session Sidejacking attacks in that in the latter attacks an attacker uses a previous or existing credential without modification while, in a forging attack, the attacker must create their own credential, although it may be based on previously observed credentials.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- The targeted application must use session credentials to identify legitimate users. Session identifiers that remains unchanged when the privilege levels change. Predictable session identifiers.
Skills required
- MediumForge the session credential and reply the request.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- AccountabilityAuthenticationAuthorizationNon-Repudiation
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
Mitigations
- Implementation: Use session IDs that are difficult to guess or brute-force: One way for the attackers to obtain valid session IDs is by brute-forcing or guessing them. By choosing session identifiers that are sufficiently random, brute-forcing or guessing becomes very difficult.
- Implementation: Regenerate and destroy session identifiers when there is a change in the level of privilege: This ensures that even though a potential victim may have followed a link with a fixated identifier, a new one is issued when the level of privilege changes.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANCIAuthentication Cache Invalidation2 shared
- D3-CCSACredential Compromise Scope Analysis2 shared
- D3-CHCredential Hardening2 shared
- D3-CRCredential Revocation2 shared
- D3-CROCredential Rotation2 shared
- D3-CTSCredential Transmission Scoping2 shared
- D3-DUCDecoy User Credential2 shared
- D3-MFAMulti-factor Authentication2 shared
- D3-RICReissue Credential2 shared
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-STSession Termination1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.