CAPEC-587
Cross Frame Scripting (XFS)
2017-02-01
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.
Thông tin CAPEC
Điều kiện tiên quyết
The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.Các biện pháp giảm thiểu
Avoid clicking on untrusted links.Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.
Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. |
Tài liệu tham khảo
REF-469
Cross Frame Scriptinghttps://www.owasp.org/index.php/Cross_Frame_Scripting
REF-470
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular SitesGustave Rydstedt, Elie Bursztein, Dan Boneh, and Collin Jackson.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction, Mitigations, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, Related_Attack_Patterns, Related_Weaknesses |
