The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:
A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.
Steal passwords, tokens, keys, and session material.
Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.
Secret managers, short-lived tokens, and no secrets in code/env/logs.
Gather the valuable data before taking it out.
Databases, files, customer records, source code, and business data.
Data-access monitoring, encryption at rest, and least-privilege data access.
Keep a remote channel to control the compromised system.
Outbound network paths the attacker uses to receive commands and stage tools.
Egress filtering, DNS/traffic monitoring, and blocking anomalous outbound connections.
This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.