COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-201

Serialized Data External Linking

An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Survey the target

Using a browser or an automated tool, an adversary records all instances of web services that process requests with serialized data.

Kullanılan teknikler

  • Use an automated tool to record all instances of URLs that process requests with serialized data.
  • Use a browser to manually explore the website and analyze how the application processes serialized data requests.
2

Exploit

Craft malicious payload

The adversary crafts malicious data message that contains references to sensitive files.

Launch an External Linking attack

Send the malicious crafted message containing the reference to a sensitive file to the target URL.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The target must follow external data references without validating the validity of the reference target.

Gerekli beceri

  • Low: To send serialized data messages with maliciously crafted schema.

Gerekli kaynak

  • None: No specialized resources are required to execute this type of attack.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Configure the serialized data processor to only retrieve external entities from trusted sources.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
The following DTD would attempt to open the /dev/tty device: <!DOCTYPE doc [ <!ENTITY ent SYSTEM "file:///dev/tty"> ]> A malicious actor could use this crafted DTD to reveal sensitive information.
Örnek olay 2Detay
The following XML snippet would attempt to open the /etc/passwd file: <foo xmlns:xi="http://www.w3.org/2001/XInclude"> <xi:include parse="text" href="file:///etc/passwd"/></foo>
CAPEC-201: Serialized Data External Linking — DayBreach Saldırı Sözlüğü · DayBreach