cve.bz

CAPEC-39

Manipulating Opaque Client-based Data Tokens

Medium severityHigh likelihoodStandard pattern

In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampering through use of encryption or obfuscation.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-39: Manipulating Opaque Client-based Data Tokens: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/39.html and https://cve.bz/cve/capec/39?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Enumerate information passed to client side] The attacker identifies the parameters used as part of tokens to take business or security decisions

      6 techniques
      • Use WebScarab to reveal hidden fields while browsing.
      • Use a sniffer to capture packets
      • View source of web page to find hidden fields
      • Examine URL to see if any opaque tokens are in it
      • Disassemble or decompile client-side application
      • Use debugging tools such as File Monitor, Registry Monitor, Debuggers, etc.

    2. [Determine protection mechanism for opaque token] The attacker determines the protection mechanism used to protect the confidentiality and integrity of these data tokens. They may be obfuscated or a full blown encryption may be used.

      3 techniques
      • Look for signs of well-known character encodings
      • Look for cryptographic signatures
      • Look for delimiters or other indicators of structure

  2. Experiment

    They probe what they found.

    1. [Modify parameter/token values] Trying each parameter in turn, the attacker modifies the values

      5 techniques
      • Modify tokens logically
      • Modify tokens arithmetically
      • Modify tokens bitwise
      • Modify structural components of tokens
      • Modify order of parameters/tokens

    2. [Cycle through values for each parameter.] Depending on the nature of the application, the attacker now cycles through values of each parameter and observes the effects of this modification in the data returned by the server

      4 techniques
      • Use network-level packet injection tools such as netcat
      • Use application-level data modification tools such as Tamper Data, WebScarab, TamperIE, etc.
      • Use modified client (modified by reverse engineering)
      • Use debugging tools to modify data in client

Prerequisites

  • An attacker already has some access to the system or can steal the client based data tokens from another user who has access to the system.

  • For an Attacker to viably execute this attack, some data (later interpreted by the application) must be held client-side in a way that can be manipulated without detection. This means that the data or tokens are not CRCd as part of their value or through a separate meta-data store elsewhere.

Skills required

  • Medium skill

    If the client site token is obfuscated.

  • High skill

    If the client site token is encrypted.

Resources required

  • The Attacker needs no special hardware-based resources in order to conduct this attack. Software plugins, such as Tamper Data for Firefox, may help in manipulating URL- or cookie-based data.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Modify DataIntegrity
Gain PrivilegesConfidentiality, Access Control, Authorization

Mitigations

  • One solution to this problem is to protect encrypted data with a CRC of some sort. If knowing who last manipulated the data is important, then using a cryptographic "message authentication code" (or hMAC) is prescribed. However, this guidance is not a panacea. In particular, any value created by (and therefore encrypted by) the client, which itself is a "malicious" value, all the protective cryptography in the world can't make the value 'correct' again. Put simply, if the client has control over the whole process of generating and encoding the value, then simply protecting its integrity doesn't help.

  • Make sure to protect client side authentication tokens for confidentiality (encryption) and integrity (signed hash)

  • Make sure that all session tokens use a good source of randomness

  • Perform validation on the server side to make sure that client side data tokens are consistent with what is expected.

Weaknesses it exploits

  • CWE-233 Improper Handling of Parameters
  • CWE-285 Improper Authorization
  • CWE-302 Authentication Bypass by Assumed-Immutable Data
  • CWE-315 Cleartext Storage of Sensitive Information in a Cookie
  • CWE-353 Missing Support for Integrity Check
  • CWE-384 Session Fixation
  • CWE-472 External Control of Assumed-Immutable Web Parameter
  • CWE-539 Use of Persistent Cookies Containing Sensitive Information
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking

Recent CVEs with these weaknesses

  1. –CVE-2026-97890

    The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authent…

  2. 9.4CVE-2026-119446

    Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_s…

  3. 2.1CVE-2026-125078

    A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely.…

  4. 7.4CVE-2026-123801

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…

  5. 2.1CVE-2026-124621

    A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Bo…

  6. 5.5CVE-2026-124590

    A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/c…

  7. 5.3CVE-2026-113702

    A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The man…

  8. –CVE-2026-40913

    Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG …

The newest records naming one of them. Each weakness's page lists them all.

Part of
More specific patterns
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies

Examples

With certain price watching websites, that aggregate products available prices, the user can buy items throug…

With certain price watching websites, that aggregate products available prices, the user can buy items through whichever vendors has product availability, the best price, or other differentiator. Once a user selects an item, the site must broker the purchase of that item with the vendor. Because vendors sell the same product through different channel partners at different prices, token exchange between price watching sites and selling vendors will often contain pricing information. With some price watching sites, manipulating URL-data (which is encrypted) even opaquely yields different prices charged by the fulfilling vendor. If the manipulated price turns out higher, the Attacker can cancel purchase. If the Attacker succeeded in manipulating the token and creating a lower price, they proceed.

Upon successful authentication user is granted an encrypted authentication cookie by the server and it is sto…

Upon successful authentication user is granted an encrypted authentication cookie by the server and it is stored on the client. One piece of information stored in the authentication cookie reflects the access level of the user (e.g. "u" for user). The authentication cookie is encrypted using the Electronic Code Book (ECB) mode, that naively encrypts each of the plaintext blocks to each of the ciphertext blocks separately. An attacker knows the structure of the cookie and can figure out what bits (encrypted) store the information relating to the access level of the user. An attacker modifies the authentication cookie and effectively substitutes "u" for "a" by flipping some of the corresponding bits of ciphertext (trial and error). Once the correct "flip" is found, when the system is accessed, the attacker is granted administrative privileges in the system. Note that in this case an attacker did not have to figure out the exact encryption algorithm or find the secret key, but merely exploit the weakness inherent in using the ECB encryption mode.

Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1…

Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1. See also: CVE-2006-0944

MITRE's words, unchanged: CAPEC-39 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.