CAPEC-587
Cross Frame Scripting (XFS)
2017-02-01
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
CAPEC 정보
사전 조건
The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.완화 방법
Avoid clicking on untrusted links.Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.
관련 약점
| 약점 이름 | |
|---|---|
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. |
참고 자료
REF-469
Cross Frame Scriptinghttps://www.owasp.org/index.php/Cross_Frame_Scripting
REF-470
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular SitesGustave Rydstedt, Elie Bursztein, Dan Boneh, and Collin Jackson.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction, Mitigations, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses |
