Improper Enforcement of Message Integrity During Transmission in a Communication Channel
This vulnerability occurs when an application receives data over a network but fails to properly verify that the information wasn't altered in transit.
When a message travels across a network without integrity protection, an attacker positioned between the sender and receiver can intercept and modify its contents. This could involve changing critical data like transaction amounts, configuration settings, or authentication details, leading the receiving application to process fraudulent or corrupted information as if it were legitimate. Attackers achieve this either by directly manipulating data packets on the wire (man-in-the-middle attacks) or by tricking the application into connecting to a malicious server they control. Without mechanisms like cryptographic message authentication codes (MACs), digital signatures, or secure channel protocols (TLS), the application has no reliable way to detect these alterations, making spoofing and data corruption successful.
Impact: Gain Privileges or Assume Identity
If an attackers can spoof the endpoint, the attacker gains all the privileges that were intended for the original endpoint.