CAPEC-94

Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first flows through the adversary, who has the opportunity to observe or alter it, before being passed on to the intended recipient as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for these attacks yields an implicit lack of trust in communication or identify between two components.

These attacks differ from Sniffing Attacks (CAPEC-157) since these attacks often modify the communications prior to delivering it to the intended recipient.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Determine Communication Mechanism] The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit.

      2 techniques

      • Perform a sniffing attack and observe communication to determine a communication protocol.
      • Look for application documentation that might describe a communication mechanism used by a target.

2. Experiment

   They probe what they found.

   2. [Position In Between Targets] The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.

      2 techniques

      • Install spyware on a client that will intercept outgoing packets and route them to their destination as well as route incoming packets back to the client.
      • Exploit a weakness in an encrypted communication mechanism to gain access to traffic. Look for outdated mechanisms such as SSL.

3. Exploit

   They carry out the attack.

   3. [Use Intercepted Data Maliciously] The adversary observes, filters, or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.

      1 technique

      • Prevent some messages from reaching their destination, causing a denial of service.

Prerequisites

• There are two components communicating with each other.

• An attacker is able to identify the nature and mechanism of communication between the two target components.

• An attacker can eavesdrop on the communication between the target components.

• Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.

• The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

Skills required

• Medium skill

  This attack can get sophisticated since the attack may use cryptography.

Consequences

Mitigations

• Ensure Public Keys are signed by a Certificate Authority

• Encrypt communications using cryptography (e.g., SSL/TLS)

• Use Strong mutual authentication to always fully authenticate both ends of any communications channel.

• Exchange public keys using a secure channel

Weaknesses it exploits

• CWE-287 Improper Authentication
• CWE-290 Authentication Bypass by Spoofing
• CWE-294 Authentication Bypass by Capture-replay
• CWE-300 Channel Accessible by Non-Endpoint
• CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

Recent CVEs with these weaknesses

1. –CVE-2026-978742026-11-10

   When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJ…

2. –CVE-2026-978802026-11-10

   The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication.…

3. –CVE-2026-1112402026-11-10

   The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deploymen…

4. –CVE-2026-1112502026-11-10

   The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served b…

5. –CVE-2026-1112612026-11-10

   The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user with…

6. 7.4CVE-2026-1209992026-11-10

   Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Account…

7. 8.1CVE-2026-768772026-11-10

   The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler genera…

8. 8.9CVE-2026-769662026-11-10

   Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management,…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Can lead to

• CAPEC-151 Identity Spoofing
• CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)

More specific patterns

• CAPEC-219 XML Routing Detour Attacks
• CAPEC-384 Application API Message Manipulation via Man-in-the-Middle
• CAPEC-386 Application API Navigation Remapping
• CAPEC-466 Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
• CAPEC-662 Adversary in the Browser (AiTB)
• CAPEC-701 Browser in the Middle (BiTM)

Examples

MITRE's words, unchanged: CAPEC-94 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.