COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-182

Flash Injection

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

Abstraction

Standard

Typical severity

Medium

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

Execution flow

How does the attack proceed, step by step?

1

Explore

Find Injection Entry Points

The attacker first takes an inventory of the entry points of the application.

Techniques used

  • Spider the website for all available URLs that reference a Flash application.
  • List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies.
2

Experiment

Determine the application's susceptibility to Flash injection

Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.

Techniques used

  • Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg
  • Test the page using controlled evil page/host, http://example.com/evil.swf
  • Test the page using Flash HTML injection, "'><img src='asfunction:getURL,javascript:gotRoot("")//.jpg' >
  • Test the page using DOM injection, (gotRoot(''))
3

Exploit

Inject malicious content into target

Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

Requirements

What does the attack require?

Prerequisites

  • The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

Skills required

  • Medium: The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

Resources required

  • None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.

Impact

What does a successful attack lead to?

Other

Affected scopes: Confidentiality

Modify Data

Affected scopes: Integrity

Read Data

Affected scopes: Confidentiality

Execute Unauthorized Commands

Affected scopes: Authorization

Gain Privileges

Affected scopes: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Affected scopes: Access Control, Authorization

Defence

How is it prevented and mitigated?

1
Implementation: remove sensitive information such as user name and password in the SWF file.
2
Implementation: use validation on both client and server side.
3
Implementation: remove debug information.
4
Implementation: use SSL when loading external data
5
Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

Real world

MITRE example instances

Example instance 1Detail
In the following example, the SWF file contains getURL('javascript:SomeFunc("someValue")','','GET') A request like http://example.com/noundef.swf?a=0:0;alert('XSS') becomes javascript:SomeFunc("someValue")?a=0:0;alert(123)