COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-212

Functionality Misuse

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.

Soyutlama

Meta

Tipik ciddiyet

Medium

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes.

Gerekli beceri

  • Low: General computer knowledge about how applications are launched, how they interact with input/output, and how they are configured.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Confidentiality

Other

Etkilenen alanlar: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.
2
When implementing security features, consider how they can be misused and compromised.