COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-279

SOAP Manipulation

Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.

Execution flow

How does the attack proceed, step by step?

1

Experiment

Detect Incorrect SOAP Parameter Handling

The adversary tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.

Techniques used

  • Send more data than would seem reasonable for a field and see if the server complains.
  • Send nonsense data in a field that expects a certain subset, such as product names or sequence numbers, and see if the server complains.
  • Send XML metacharacters as data and see how the server responds.
2

Exploit

Find target application

The adversary needs to identify an application that uses SOAP as a communication protocol.

Techniques used

  • Observe HTTP traffic to an application and look for SOAP headers.

Manipulate SOAP parameters

The adversary manipulates SOAP parameters in a way that causes undesirable behavior for the server. This can result in denial of service, information disclosure, arbitrary code exection, and more.

Techniques used

  • Create a recursive XML payload that will take up all of the memory on the server when parsed, resulting in a denial of service. This is known as the billion laughs attack.
  • Insert XML metacharacters into data fields that could cause the server to go into an error state when parsing. This could lead to a denial of service.
  • Insert a large amount of data into a field that should have a character limit, causing a buffer overflow.

Requirements

What does the attack require?

Prerequisites

  • An application uses SOAP-based web service api.
  • An application does not perform sufficient input validation to ensure that user-controllable data is safe for an XML parser.
  • The targeted server either fails to verify that data in SOAP messages conforms to the appropriate XML schema, or it fails to correctly handle the complete range of data allowed by the schema.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Resource Consumption

Affected scopes: Availability

Read Data

Affected scopes: Confidentiality

Execute Unauthorized Commands

Affected scopes: Confidentiality, Integrity, Availability

CAPEC-279: SOAP Manipulation — DayBreach Saldırı Sözlüğü · DayBreach