CAPEC-467
Cross Site Identification
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).
On this page
There are many other ways in which the attacker may get the payload to execute in the victim's browser mainly by finding a way to hide it in some reputable site that the victim visits. The attacker could also send the link to the victim in an e-mail and trick the victim into clicking on the link. This attack is basically a cross site request forgery attack with two main differences. First, there is no action that is performed on behalf of the user aside from harvesting information. So standard CSRF protection may not work in this situation. Second, what is important in this attack pattern is the nature of the data being harvested, which is identifying information that can be obtained and used in context. This real time harvesting of identifying information can be used as a prelude for launching real time targeted social engineering attacks on the victim.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-467: Cross Site Identification: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/467.html and https://cve.bz/cve/capec/467?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The victim has an active session with the social networking site.
Skills required
- High skill
An attacker should be able to create a payload and deliver it to the victim's browser.
- Medium skill
An attacker needs to know how to interact with various social networking sites (e.g., via available APIs) to request information and how to send the harvested data back to the attacker.
Mitigations
Usage: Users should always explicitly log out from the social networking sites when done using them.
Usage: Users should not open other tabs in the browser when using a social networking site.
Weaknesses it exploits
- CWE-352 Cross-Site Request Forgery
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Recent CVEs with these weaknesses
- 8.2CVE-2026-124037
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a register…
- 5.1CVE-2026-112137
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and …
- 5.3CVE-2026-60041
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This ca…
- 4.3CVE-2026-89131
SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an…
- 9.6CVE-2026-89119
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispa…
- 7.6CVE-2026-120014
SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visit…
- 2.1CVE-2026-125077
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible …
- 7.5CVE-2026-119755
Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-62 Cross Site Request Forgery
Examples
An attacker may post a malicious posting that contains an image with an embedded link. The link actually requ…
An attacker may post a malicious posting that contains an image with an embedded link. The link actually requests identifying information from the social networking site. A victim who views the malicious posting in their browser will have sent identifying information to the attacker, as long as the victim had an active session with the social networking site.
MITRE's words, unchanged: CAPEC-467 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.