|
|
|
|
CAPEC-114: Authentication Abuse |
 Description An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. Extended Description This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns. Typical Severity Prerequisites
| An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc. which is flawed in some way. |
Resources Required
| A client application, command-line access to a binary, or scripting language capable of interacting with the authentication mechanism. |
Taxonomy Mappings  CAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.Relevant to the ATT&CK taxonomy mapping | Entry ID | Entry Name |
|---|
| 1548 | Abuse Elevation Control Mechanism |
 Content History | Submissions |
|---|
| Submission Date | Submitter | Organization |
|---|
| 2014-06-23 (Version 2.6) | CAPEC Content Team | The MITRE Corporation | | | Modifications |
|---|
| Modification Date | Modifier | Organization |
|---|
| 2015-11-09 (Version 2.7) | CAPEC Content Team | The MITRE Corporation | | Updated Related_Attack_Patterns | | 2020-07-30 (Version 3.3) | CAPEC Content Team | The MITRE Corporation | | Updated Related_Weaknesses | | 2021-06-24 (Version 3.5) | CAPEC Content Team | The MITRE Corporation | | Updated Taxonomy_Mappings | | 2022-02-22 (Version 3.7) | CAPEC Content Team | The MITRE Corporation | | Updated Description, Extended_Description |
More information is available — Please select a different filter.
|
