CAPEC-465
Transparent Proxy Abuse
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.
CAPEC 정보
사전 조건
Transparent proxy is usedVulnerable configuration of network topology involving the transparent proxy (e.g., no NAT happening between the client and the proxy)Execution of malicious Flash or Applet in the victim's browser필요 기술
Creating malicious Flash or Applet to open a cross-domain socket connection to a remote system완화 방법
Design: Ensure that the transparent proxy uses an actual network layer IP address for routing requests. On the transparent proxy, disable the use of routing based on address information in the HTTP host header.Configuration: Disable in the browser the execution of Java Script, Flash, SilverLight, etc.
관련 약점
| 약점 이름 | |
|---|---|
CWE-441 |
Unintended Proxy or Intermediary The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. |
참고 자료
REF-402
Socket Capable Browser Plugins Result In Transparent Proxy AbuseRobert Auger.
http://www.thesecuritypractice.com/the_security_practice/TransparentProxyAbuse.pdf
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction | |
| CAPEC Content Team | The MITRE Corporation | Updated Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
