CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
Description
This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control, Collect and Analyze Information
Prerequisites
- Target server software must be a HTTP daemon that relies on cookies.
- The cookies must contain sensitive information.
- The adversary must be able to make HTTP requests to the server, and the cookie must be contained in the reply.
Skills required
- LowTo overwrite session cookie data, and submit targeted attacks via HTTP
- HighExploiting a remote buffer overflow generated by attack
Consequences
- Confidentiality
Read Data
- Integrity
Modify Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Design: Use input validation for cookies
- Design: Generate and validate MAC for cookies
- Implementation: Use SSL/TLS to protect cookie in transit
- Implementation: Ensure the web server implements all relevant security patches, many exploitable buffer overflows are fixed in patches issued for the software.
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-302Authentication Bypass by Assumed-Immutable Data
- CWE-311Missing Encryption of Sensitive Data
- CWE-315Cleartext Storage of Sensitive Information in a Cookie
- CWE-384Session Fixation
- CWE-472External Control of Assumed-Immutable Web Parameter
- CWE-539Use of Persistent Cookies Containing Sensitive Information
- CWE-565Reliance on Cookies without Validation and Integrity Checking
- CWE-602Client-Side Enforcement of Server-Side Security
- CWE-642External Control of Critical State Data
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared
- D3-CROCredential Rotation1 shared
- D3-CTSCredential Transmission Scoping1 shared
- D3-DUCDecoy User Credential1 shared
- D3-MFAMulti-factor Authentication1 shared
- D3-RICReissue Credential1 shared