CAPEC-587
Cross Frame Scripting (XFS)
2017-02-01
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
CAPEC の情報
前提条件
The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.緩和策
Avoid clicking on untrusted links.Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.
関連する弱点
| 弱点名 | |
|---|---|
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. |
参考文献
REF-469
Cross Frame Scriptinghttps://www.owasp.org/index.php/Cross_Frame_Scripting
REF-470
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular SitesGustave Rydstedt, Elie Bursztein, Dan Boneh, and Collin Jackson.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction, Mitigations, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses |
