CAPEC-481

Contradictory Destinations in Traffic Routing Schemes

High severityMedium likelihoodStandard pattern

Adversaries can provide contradictory destinations when sending messages. Traffic is routed in networks using the domain names in various headers available at different levels of the OSI model. In a Content Delivery Network (CDN) multiple domains might be available, and if there are contradictory domain names provided it is possible to route traffic to an inappropriate destination. The technique, called Domain Fronting, involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. An alternative technique, called Domainless Fronting, is similar, but the SNI field is left blank.

On this page

Ask an AI about this attack pattern
Prerequisites
Skills required
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-481: Contradictory Destinations in Traffic Routing Schemes: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/481.html and https://cve.bz/cve/capec/481?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

Prerequisites

An adversary must be aware that their message will be routed using a CDN, and that both of the contradictory domains are served from that CDN.
If the purpose of the Domain Fronting is to hide redirected C2 traffic, the C2 server must have been created in the CDN.

Skills required

Medium skill
The adversary must have some knowledge of how messages are routed.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Read Data, Modify Data	Confidentiality

Mitigations

Monitor connections, checking headers in traffic for contradictory domain names, or empty domain names.

Weaknesses it exploits

CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Recent CVEs with these weaknesses

7.2CVE-2026-1253612026-11-10
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification…
7.7CVE-2026-107562026-10-27
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with loca…
5.0CVE-2026-1109092026-10-15
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code sub…
6.9CVE-2026-1020852026-10-14
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact t…
8.2CVE-2026-859252026-10-13
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
7.0CVE-2026-702122026-10-13
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
9.0CVE-2026-863452026-10-02
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS…
9.1CVE-2026-921732026-09-30
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. Tha…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-161 Infrastructure Manipulation

MITRE's words, unchanged: CAPEC-481 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.