COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-182

Flash Injection

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

Soyutlama

Standard

Tipik ciddiyet

Medium

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Find Injection Entry Points

The attacker first takes an inventory of the entry points of the application.

Kullanılan teknikler

  • Spider the website for all available URLs that reference a Flash application.
  • List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies.
2

Experiment

Determine the application's susceptibility to Flash injection

Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.

Kullanılan teknikler

  • Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg
  • Test the page using controlled evil page/host, http://example.com/evil.swf
  • Test the page using Flash HTML injection, "'><img src='asfunction:getURL,javascript:gotRoot("")//.jpg' >
  • Test the page using DOM injection, (gotRoot(''))
3

Exploit

Inject malicious content into target

Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

Gerekli beceri

  • Medium: The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

Gerekli kaynak

  • None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.

Etki

Başarılı saldırı neye yol açar?

Other

Etkilenen alanlar: Confidentiality

Modify Data

Etkilenen alanlar: Integrity

Read Data

Etkilenen alanlar: Confidentiality

Execute Unauthorized Commands

Etkilenen alanlar: Authorization

Gain Privileges

Etkilenen alanlar: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Etkilenen alanlar: Access Control, Authorization

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Implementation: remove sensitive information such as user name and password in the SWF file.
2
Implementation: use validation on both client and server side.
3
Implementation: remove debug information.
4
Implementation: use SSL when loading external data
5
Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
In the following example, the SWF file contains getURL('javascript:SomeFunc("someValue")','','GET') A request like http://example.com/noundef.swf?a=0:0;alert('XSS') becomes javascript:SomeFunc("someValue")?a=0:0;alert(123)
CAPEC-182: Flash Injection — DayBreach Saldırı Sözlüğü · DayBreach