CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
Last updated
Overview
CAPEC-633 (Token Impersonation) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity.
Consequences
What a successful CAPEC-633 attack can achieve.
Alter Execution Logic
Affects: Integrity
By faking the source of data or services, an adversary can cause a target to make incorrect decisions about how to proceed.
Gain Privileges
Affects: Integrity
By impersonating identities that have an increased level of access, an adversary gain privilege that they many not have otherwise had.
Hide Activities
Affects: Integrity
Faking the source of data or services can be used to create a false trail in logs as the target will associated any actions with the impersonated identity instead of the adversary.
Terminology & mappings
Mapped taxonomies
- ATTACK: Access Token Manipulation (1134)
Frequently asked questions
Common questions about CAPEC-633.
- What is CAPEC-633?
- An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
- What weaknesses does CAPEC-633 target?
- CAPEC-633 exploits 2 CWE weaknesses, including CWE-287 (Improper Authentication), CWE-1270 (Generation of Incorrect Security Tokens).
- How severe is CAPEC-633?
- MITRE rates CAPEC-633 as Medium severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-633
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.