CAPEC-386
Application API Navigation Remapping
2014-06-23
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
Thông tin CAPEC
Điều kiện tiên quyết
Targeted software is utilizing application framework APIsTài nguyên cần thiết
A software program that allows the use of adversary-in-the-middle (CAPEC-94) communications between the client and server, such as a man-in-the-middle proxy.Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-471 |
Modification of Assumed-Immutable Data (MAID) The product does not properly protect an assumed-immutable element from being modified by an attacker. |
CWE-345 |
Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
CWE-346 |
Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
CWE-602 |
Client-Side Enforcement of Server-Side Security The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server. |
CWE-311 |
Missing Encryption of Sensitive Data The product does not encrypt sensitive or critical information before storage or transmission. |
Tài liệu tham khảo
REF-327
So Many Ways [...]: Exploiting Facebook and YoVilleTom Stracener, Sean Barnum.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Resources_Required |
