COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-178

Cross-Site Flashing

An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.

Soyutlama

Detailed

Tipik ciddiyet

Medium

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Identification

Using a browser or an automated tool, an attacker records all instances of URLs (or partial URL such as domain) passed to a flash file (SWF).

Kullanılan teknikler

  • Use an automated tool to record the variables passed to a flash file.
  • Use a browser to manually explore the website and analyze how the flash file receive variables, e.g. JavaScript using SetVariable/GetVariable, HTML FlashVars param tag, etc.
  • Use decompilers to retrieve the flash source code and record all user-controllable variables passed to a loadMovie* directive.
2

Experiment

Attempt to inject a remote flash file

The attacker makes use of a remotely available flash file (SWF) that generates a uniquely identifiable output when executed inside the targeted flash file.

Kullanılan teknikler

  • Modify the variable of the SWF file that contains the remote movie URL to the attacker controlled flash file.
3

Exploit

Access or Modify Flash Application Variables

As the attacker succeeds in exploiting the vulnerability, they target the content of the flash application to steal variable content, password, etc.

Kullanılan teknikler

  • Develop malicious Flash application that is injected through vectors identified during the Experiment Phase and loaded by the victim browser's flash plugin and sends document information to the attacker.
  • Develop malicious Flash application that is injected through vectors identified during the Experiment Phase and takes commands from an attacker's server and then causes the flash application to execute appropriately.

Execute JavaScript in victim's browser

When the attacker targets the current flash application, they can choose to inject JavaScript in the client's DOM and therefore execute cross-site scripting attack.

Kullanılan teknikler

  • Develop malicious JavaScript that is injected from the rogue flash movie to the targeted flash application through vectors identified during the Experiment Phase and loaded by the victim's browser.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The targeted Flash application must reference external URLs and the locations thus referenced must be controllable through parameters. The Flash application must fail to sanitize such parameters against malicious manipulation. The victim must follow a crafted link created by the attacker.

Gerekli beceri

  • Medium: knowledge of Flash internals, parameters and remote referencing.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Modify Data

Etkilenen alanlar: Integrity

Read Data

Etkilenen alanlar: Confidentiality

Execute Unauthorized Commands

Etkilenen alanlar: Authorization

Gain Privileges

Etkilenen alanlar: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Etkilenen alanlar: Access Control, Authorization

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Implementation: Only allow known URL to be included as remote flash movies in a flash application
2
Configuration: Properly configure the crossdomain.xml file to only include the known domains that should host remote flash movies.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
The attacker tries to get their malicious flash movie to be executed in the targeted flash application. The malicious file is hosted on the attacker.com domain and the targeted flash application is hosted on example.com The crossdomain.xml file in the root of example.com allows all domains and no specific restriction is specified in the targeted flash application. When the attacker injects their malicious file in the vulnerable flash movie, the rogue flash application is able to access internal variables and parameter of the flash movie.
CAPEC-178: Cross-Site Flashing — DayBreach Saldırı Sözlüğü · DayBreach