CAPEC-388
Application API Button Hijacking
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
掌握特定 CAPEC 的任何變更。
CAPEC 描述
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
CAPEC 資訊
前置條件
Targeted software is utilizing application framework APIs所需資源
A software program that allows the use of adversary-in-the-middle (CAPEC-94) communications between the client and server, such as a adversary-in-the-middle (CAPEC-94) proxy.相關弱點
| 弱點名稱 | |
|---|---|
CWE-471 |
Modification of Assumed-Immutable Data (MAID) The product does not properly protect an assumed-immutable element from being modified by an attacker. |
CWE-345 |
Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
CWE-346 |
Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
CWE-602 |
Client-Side Enforcement of Server-Side Security The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server. |
CWE-311 |
Missing Encryption of Sensitive Data The product does not encrypt sensitive or critical information before storage or transmission. |
參考資料
REF-327
So Many Ways [...]: Exploiting Facebook and YoVilleTom Stracener, Sean Barnum.
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Description, Description Summary, Examples-Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction | |
| CAPEC Content Team | The MITRE Corporation | Updated Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances |
