cve.bz

CAPEC-31

Accessing/Intercepting/Modifying HTTP Cookies

High severityHigh likelihoodDetailed pattern

This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/31.html and https://cve.bz/cve/capec/31?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Obtain copy of cookie] The adversary first needs to obtain a copy of the cookie. The adversary may be a legitimate end user wanting to escalate privilege, or could be somebody sniffing on a network to get a copy of HTTP cookies.

      4 techniques
      • Sniff cookie using a network sniffer such as Wireshark
      • Obtain cookie using a utility such as the Firefox Cookie Manager, Chrome DevTools or AnEC Cookie Editor.
      • Steal cookie via a cross-site scripting attack.
      • Guess cookie contents if it contains predictable information.

  2. Experiment

    They probe what they found.

    1. [Obtain sensitive information from cookie] The adversary may be able to get sensitive information from the cookie. The web application developers may have assumed that cookies are not accessible by end users, and thus, may have put potentially sensitive information in them.

      2 techniques
      • If cookie shows any signs of being encoded using a standard scheme such as base64, decode it.
      • Analyze the cookie's contents to determine whether it contains any sensitive information.

    2. [Modify cookie to subvert security controls.] The adversary may be able to modify or replace cookies to bypass security controls in the application.

      4 techniques
      • Modify logical parts of cookie and send it back to server to observe the effects.
      • Modify numeric parts of cookie arithmetically and send it back to server to observe the effects.
      • Modify cookie bitwise and send it back to server to observe the effects.
      • Replace cookie with an older legitimate cookie and send it back to server to observe the effects. This technique would be helpful in cases where the cookie contains a "points balance" for a given user where the points have some value. The user may spend their points and then replace their cookie with an older one to restore their balance.

Prerequisites

  • Target server software must be a HTTP daemon that relies on cookies.

  • The cookies must contain sensitive information.

  • The adversary must be able to make HTTP requests to the server, and the cookie must be contained in the reply.

Skills required

  • Low skill

    To overwrite session cookie data, and submit targeted attacks via HTTP

  • High skill

    Exploiting a remote buffer overflow generated by attack

Resources required

  • A utility that allows for the viewing and modification of cookies. Many modern web browsers support this behavior.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Read DataConfidentiality
Modify DataIntegrity
Gain PrivilegesConfidentiality, Access Control, Authorization

Mitigations

  • Design: Use input validation for cookies

  • Design: Generate and validate MAC for cookies

  • Implementation: Use SSL/TLS to protect cookie in transit

  • Implementation: Ensure the web server implements all relevant security patches, many exploitable buffer overflows are fixed in patches issued for the software.

Weaknesses it exploits

  • CWE-20 Improper Input Validation
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
  • CWE-302 Authentication Bypass by Assumed-Immutable Data
  • CWE-311 Missing Encryption of Sensitive Data
  • CWE-315 Cleartext Storage of Sensitive Information in a Cookie
  • CWE-384 Session Fixation
  • CWE-472 External Control of Assumed-Immutable Web Parameter
  • CWE-539 Use of Persistent Cookies Containing Sensitive Information
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking
  • CWE-602 Client-Side Enforcement of Server-Side Security
  • CWE-642 External Control of Critical State Data

Recent CVEs with these weaknesses

  1. 4.9CVE-2026-105427

    Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

  2. 6.7CVE-2026-105426

    Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

  3. 9.6CVE-2026-108186

    Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

  4. –CVE-2026-97890

    The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authent…

  5. 6.3CVE-2026-125871

    The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…

  6. 5.5CVE-2026-125703

    A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancilla…

  7. 9.4CVE-2026-119446

    Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_s…

  8. 2.1CVE-2026-125078

    A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely.…

The newest records naming one of them. Each weakness's page lists them all.

Part of

Examples

There are two main attack vectors for exploiting poorly protected session variables like cookies. One is the …

There are two main attack vectors for exploiting poorly protected session variables like cookies. One is the local machine itself which can be exploited directly at the physical level or indirectly through XSS and phishing. In addition, the adversary in the middle attack (CAPEC-94) relies on a network sniffer, proxy, or other intermediary to intercept the subject's credentials and use them to impersonate the digital subject on the host. The issue is that once the credentials are intercepted, impersonation is trivial for the adversary to accomplish if no other protection mechanisms are in place. See also: CVE-2010-5148 , CVE-2016-0353

MITRE's words, unchanged: CAPEC-31 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.