CWE-522
Allowed-with-ReviewInsufficiently Protected Credentials
Abstraction: Class · Status: Incomplete
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
1938 vulnerabilities reference this CWE, most recent first.
GHSA-2RCP-JVR4-R259
Vulnerability from github – Published: 2023-10-20 15:18 – Updated: 2023-12-19 19:08Impact
This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration.
The Tauri documentation used an insecure example configuration in the Vite guide to showcase how to use Tauri together with Vite.
Copying the following snippet envPrefix: ['VITE_', 'TAURI_'], from this guide into the vite.config.ts of a Tauri project possibly leads to bundling the TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD into the Vite frontend code and therefore leaking this value to the debug built of a Tauri application.
The value is automatically bundled into debug builds but for production builds it is not embedded, as long as it is not directly referenced in the frontend code. Vite statically replaces these values in production builds. This reduces the amount of affected applications to a very small amount of affected applications.
To verify if you are affected you can search for the private key value or the TAURI_PRIVATE_KEY variable inside the release build frontend assets (dist/).
Example:
grep -r "TAURI_PRIVATE_KEY" dist/
Using only the envPrefix: ['VITE_'], or any other framework than Vite means you are not impacted by this advisory.
Patches
The documentation has been patched but as the root cause is not in Tauri itself the issue is not fixed by updating Tauri.
The vite.config.ts configuration of the project needs to be adapted.
We recommend rotating your updater private key if you are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with tauri signer generate, saving the new private key and updating the updater's pubkey value on tauri.conf.json with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Workarounds
The envPrefix: ['VITE_'],should be used and the desired TAURI variables manually added.
Respective these variables could be added TAURI_PLATFORM, TAURI_ARCH, TAURI_FAMILY, TAURI_PLATFORM_VERSION, TAURI_PLATFORM_TYPE and TAURI_DEBUG without leaking sensitive information.
We urge affected users to implement the workaround as the 1.x branch will not receive a general prevention fix as it would break systems.
References
The issue was originally disclosed in our discord here. The affected guide is https://tauri.app/v1/guides/getting-started/setup/vite/.
Update: We lowered the severity from high to low, as the likelihood of impact was found to only affect a very limited amount of applications.
Update2: We changed the affected versions to make clear that after
2.0.0-alpha.16or1.5.6the potentially vulnerable recommendation was no longer visible on our website and should not affect projects by default. A lot of users were confused and we believe this advisory reached the necessary user base.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "tauri-cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "2.0.0-alpha.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@tauri-apps/cli"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "2.0.0-alpha.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@tauri-apps/cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "tauri-cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46115"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-20T15:18:52Z",
"nvd_published_at": "2023-10-20T00:15:16Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThis advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration.\n\nThe Tauri documentation used an insecure example configuration in the [Vite guide](https://tauri.app/v1/guides/getting-started/setup/vite/) to showcase how to use Tauri together with Vite. \n\nCopying the following snippet `envPrefix: [\u0027VITE_\u0027, \u0027TAURI_\u0027],` from this guide into the `vite.config.ts` of a Tauri project possibly leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the debug built of a Tauri application.\n\nThe value is automatically bundled into debug builds but for production builds it is not embedded, as long as it is not directly referenced in the frontend code. Vite statically replaces these values in production builds. This reduces the amount of affected applications to a very small amount of affected applications.\n\nTo verify if you are affected you can search for the private key value or the `TAURI_PRIVATE_KEY` variable inside the release build frontend assets (`dist/`).\n\n\u003e Example: `grep -r \"TAURI_PRIVATE_KEY\" dist/`\n\nUsing only the `envPrefix: [\u0027VITE_\u0027],` or any other framework than Vite means you are not impacted by this advisory.\n\n### Patches\n\nThe documentation has been patched but as the root cause is not in Tauri itself the issue is not fixed by updating Tauri.\nThe `vite.config.ts` configuration of the project needs to be adapted.\n\nWe recommend rotating your updater private key if you are affected by this (requires Tauri CLI \u003e=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater\u0027s `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.\n\n### Workarounds\n\nThe `envPrefix: [\u0027VITE_\u0027],`should be used and the desired `TAURI` variables manually added.\nRespective these variables could be added `TAURI_PLATFORM`, `TAURI_ARCH`, `TAURI_FAMILY`, `TAURI_PLATFORM_VERSION`, `TAURI_PLATFORM_TYPE` and `TAURI_DEBUG` without leaking sensitive information.\n\nWe urge affected users to implement the workaround as the `1.x` branch will not receive a general prevention fix as it would break systems.\n\n### References\nThe issue was originally disclosed in our discord [here](https://discord.com/channels/616186924390023171/1164260301655523409).\nThe affected guide is [https://tauri.app/v1/guides/getting-started/setup/vite/](https://tauri.app/v1/guides/getting-started/setup/vite/).\n\n\n\u003e Update: We lowered the severity from high to low, as the likelihood of impact was found to only affect a **very limited** amount of applications.\n\n\u003e Update2: We changed the affected versions to make clear that after `2.0.0-alpha.16` or `1.5.6` the potentially vulnerable recommendation was no longer visible on our website and should not affect projects by default. A lot of users were confused and we believe this advisory reached the necessary user base.\n",
"id": "GHSA-2rcp-jvr4-r259",
"modified": "2023-12-19T19:08:00Z",
"published": "2023-10-20T15:18:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46115"
},
{
"type": "WEB",
"url": "https://github.com/tauri-apps/tauri/commit/8b166e9bf82e69ddb3200a3a825614980bd8d433"
},
{
"type": "WEB",
"url": "https://discord.com/channels/616186924390023171/1164260301655523409"
},
{
"type": "PACKAGE",
"url": "https://github.com/tauri-apps/tauri"
},
{
"type": "WEB",
"url": "https://tauri.app/v1/guides/getting-started/setup/vite"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Tauri\u0027s Updater Private Keys Possibly Leaked via Vite Environment Variables"
}
GHSA-2RP4-HM5G-P38J
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.
{
"affected": [],
"aliases": [
"CVE-2019-19843"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-22T19:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.",
"id": "GHSA-2rp4-hm5g-p38j",
"modified": "2022-05-24T17:07:07Z",
"published": "2022-05-24T17:07:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19843"
},
{
"type": "WEB",
"url": "https://alephsecurity.com/2020/01/14/ruckus-wireless"
},
{
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html"
},
{
"type": "WEB",
"url": "https://www.ruckuswireless.com/security/299/view/txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2V3R-QQR5-3X33
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.
{
"affected": [],
"aliases": [
"CVE-2020-6794"
],
"database_specific": {
"cwe_ids": [
"CWE-312",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-02T05:15:00Z",
"severity": "MODERATE"
},
"details": "If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird \u003c 68.5.",
"id": "GHSA-2v3r-qqr5-3x33",
"modified": "2022-05-24T17:10:01Z",
"published": "2022-05-24T17:10:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6794"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1606619"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-10"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4328-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4335-1"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-07"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2V62-48MQ-RGVP
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2022-05-24 22:00Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.
{
"affected": [],
"aliases": [
"CVE-2019-11663"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-18T22:15:00Z",
"severity": "MODERATE"
},
"details": "Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.",
"id": "GHSA-2v62-48mq-rgvp",
"modified": "2022-05-24T22:00:38Z",
"published": "2022-05-24T22:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11663"
},
{
"type": "WEB",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03518316"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2V6F-8P47-F6X8
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
{
"affected": [],
"aliases": [
"CVE-2020-26905"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-09T07:15:00Z",
"severity": "HIGH"
},
"details": "Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.",
"id": "GHSA-2v6f-8p47-f6x8",
"modified": "2022-05-24T17:30:24Z",
"published": "2022-05-24T17:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26905"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000062349/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0047"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2W8W-7V4C-MFG3
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-08-13 00:00User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.
{
"affected": [],
"aliases": [
"CVE-2021-35050"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-25T12:15:00Z",
"severity": "HIGH"
},
"details": "User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.",
"id": "GHSA-2w8w-7v4c-mfg3",
"modified": "2022-08-13T00:00:34Z",
"published": "2022-05-24T19:06:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35050"
},
{
"type": "WEB",
"url": "https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies"
},
{
"type": "WEB",
"url": "https://www.securifera.com/blog/2021/06/24/operation-eagle-eye"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2WFG-X9MX-MRX5
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.
{
"affected": [],
"aliases": [
"CVE-2020-9476"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.",
"id": "GHSA-2wfg-x9mx-mrx5",
"modified": "2022-05-24T17:10:09Z",
"published": "2022-05-24T17:10:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9476"
},
{
"type": "WEB",
"url": "https://arris.secure.force.com/consumers/ConsumerProductSupport"
},
{
"type": "WEB",
"url": "https://medium.com/@rsantos_14778/info-disclosure-cve-2020-9476-494a08298c6b"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2WMQ-3M94-G4JR
Vulnerability from github – Published: 2026-06-15 15:31 – Updated: 2026-06-15 15:31Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651
{
"affected": [],
"aliases": [
"CVE-2026-6517"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T14:16:37Z",
"severity": "MODERATE"
},
"details": "Mattermost Desktop App versions \u003c=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651",
"id": "GHSA-2wmq-3m94-g4jr",
"modified": "2026-06-15T15:31:33Z",
"published": "2026-06-15T15:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6517"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2WPX-P7QG-954W
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:33CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
{
"affected": [],
"aliases": [
"CVE-2019-3800"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-05T17:15:00Z",
"severity": "HIGH"
},
"details": "CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.",
"id": "GHSA-2wpx-p7qg-954w",
"modified": "2024-04-04T01:33:07Z",
"published": "2022-05-24T16:52:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3800"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2019-3800"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/blog/cve-2019-3800"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2X3G-RR4W-4QRP
Vulnerability from github – Published: 2025-03-19 18:30 – Updated: 2025-03-21 15:41Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.0.31.v4a"
},
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:zohoqengine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.31.v4a_b_1db_6d6a_f2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-30197"
],
"database_specific": {
"cwe_ids": [
"CWE-522",
"CWE-549"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T13:17:59Z",
"nvd_published_at": "2025-03-19T16:15:34Z",
"severity": "LOW"
},
"details": "Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.",
"id": "GHSA-2x3g-rr4w-4qrp",
"modified": "2025-03-21T15:41:33Z",
"published": "2025-03-19T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30197"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/zohoqengine-plugin/commit/4ab1db6d6af21f43dd15cc328599445519875fa8"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/zohoqengine-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-03-19/#SECURITY-3511"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Jenkins Zoho QEngine Plugin Displays Unmasked API Keys"
}
Mitigation
Use an appropriate security mechanism to protect the credentials.
Mitigation
Make appropriate use of cryptography to protect the credentials.
Mitigation
Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
CAPEC-102: Session Sidejacking
Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
CAPEC-474: Signature Spoofing by Key Theft
An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.
CAPEC-509: Kerberoasting
Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service ticket with portions encrypted via RC4 with the private key of the authenticated account. By extracting the local ticket and saving it disk, the adversary can brute force the hashed value to reveal the target account credentials.
CAPEC-551: Modify Existing Service
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
CAPEC-555: Remote Services with Stolen Credentials
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-561: Windows Admin Shares with Stolen Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-644: Use of Captured Hashes (Pass The Hash)
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
CAPEC-645: Use of Captured Tickets (Pass The Ticket)
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.