CAPEC-387
Navigation Remapping To Propagate Malicious Content
MEDIUM
Draft
2014-06-23 00:00 +00:00
2022-09-29 00:00 +00:00
Alerte pour un CAPEC
Stay informed of any changes for a specific CAPEC.
Description
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
Informations
Prerequisites
Targeted software is utilizing application framework APIsResources Required
A software program that allows the use of adversary-in-the-middle communications between the client and server, such as a man-in-the-middle proxy.Related Weaknesses
| Weakness Name | |
|---|---|
| Modification of Assumed-Immutable Data (MAID) The product does not properly protect an assumed-immutable element from being modified by an attacker. |
|
| Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
|
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
|
| Client-Side Enforcement of Server-Side Security The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
|
| Missing Encryption of Sensitive Data The product does not encrypt sensitive or critical information before storage or transmission. |
References
REF-327
So Many Ways [...]: Exploiting Facebook and YoVilleTom Stracener, Sean Barnum.
Submission
| Name | Organization | Date | Date Release |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modifications
| Name | Organization | Date | Comment |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated @Abstraction | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description |
2024©
tesweb SA
