CAPEC-477
Signature Spoofing by Mixing Signed and Unsigned Content
An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/477.html and https://cve.bz/cve/capec/477?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
Signer and recipient are using complex data storage structures that allow for a mix between signed and unsigned data
Recipient is using signature verification software that does not maintain separation between signed and unsigned data once the signature has been verified.
Skills required
- High skill
The attacker may need to continuously monitor a stream of signed data, waiting for an exploitable message to appear.
- High skill
Attacker must be able to create malformed data blobs and know how to insert them in a location that the recipient will visit.
Mitigations
Ensure the application is fully patched and does not allow the processing of unsigned data as if it is signed data.
Weaknesses it exploits
- CWE-311 Missing Encryption of Sensitive Data
- CWE-319 Cleartext Transmission of Sensitive Information
- CWE-693 Protection Mechanism Failure
Recent CVEs with these weaknesses
- 6.8CVE-2026-18128
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.
- 10.0CVE-2026-124600
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
- 8.1CVE-2026-115338
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
- 6.5CVE-2026-18668
IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protocol downgrade attacks due to a security misconfiguration.
- 3.6CVE-2026-102618
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable.
- 6.9CVE-2026-123556
ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height…
- 7.6CVE-2026-123497
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HT…
- 5.5CVE-2025-55002
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-473 Signature Spoof
MITRE's words, unchanged: CAPEC-477 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.