TechKnowSurge
TechKnowSurge Catalog Videos Confused Deputy
VideoSecurityFree

Confused Deputy

The confused deputy attack exploits trust relationships between programs, tricking a privileged process into performing actions on behalf of a less-privileged one that would otherwise be denied. It falls under CWE-441 and represents a common class of software trust exploitation.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The confused deputy is a class of trust exploitation attack catalogued as CWE-441 in the Common Weakness Enumeration, a widely used reference for software security vulnerabilities. The core issue arises when a software component receives a request and processes it without adequately preserving or verifying the identity of the original requesting source, allowing a less-privileged program to effectively borrow the authority of a more-privileged one. A straightforward example illustrates the mechanic: one program holds direct read and write access to a protected memory region because it is a trusted process, while a second program lacks those permissions entirely. Rather than attempting to access that memory directly, the second program routes its request through the first, which processes it and returns the result. The first program acts as an unwitting intermediary, and the second program achieves something it was explicitly not authorized to do. This type of attack is significant because it does not require breaking authentication or exploiting a buffer overflow — it exploits the trust architecture itself. Defenses against confused deputy attacks typically involve enforcing that intermediary programs validate and preserve the original caller's identity and privilege level before executing any sensitive operation on that caller's behalf.

What you'll learn

What's covered

Confused Deputy Attack

Key terms

Confused Deputy
An attack pattern where a lower-privileged process tricks a higher-privileged process into performing unauthorized actions on its behalf by exploiting the trusted process's authority.
Privilege Escalation
An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Least Privilege
A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.

Topics

Confused Deputy Privilege Escalation Access Control Software Security Trust Exploitation Cwe 441

Transcript

Another example of a trust exploitation is confused deputy, so let's talk about confused deputy.

Finding it in the CWE

Here I'm on the common weakness enumeration site, where we can see common weaknesses with applications. What I'm going to do is expand all and do a Ctrl-F to find the word confused. We see just one instance of this, and it talks about the confused deputy, or CWE-441. So let's go ahead and take a look at that.

With CWE-441, it doesn't give us a diagram or any kind of illustration here, but it does say the product receives a request message or directive from an upstream component, but the product does not sufficiently preserve the original source of the request. So essentially what it's saying there is a trust exploitation. The product, which is software, receives a request message or directive, so there's some sort of request that's happening that this product is going to process, but it's going to do it for another program.

An example

Let's look at an example of that here. We've got a program one who maybe has some sort of direct access to memory. So this program is able to go in and read and write and everything directly to the memory, because it's a trusted program. But program two is also operating, and it does not have the same rights to do the read and write directly to the memory. So what it does is it makes a call through program one. Program one goes and retrieves that information and passes it off to program two. So essentially, program two has gotten program one to do what program two shouldn't be allowed to do.

Here's the attack card on confused deputy, where program two tricks program one to do some sort of execution. In this case, it's on a CPU. So a program is tricking another program into misusing authority.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →