CAPEC-107: Cross Site Tracing

MITRE CAPEC attack pattern

Description

Cross Site Tracing (XST) enables an adversary to steal the victim's session cookie and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to a destination system's web server.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-648, CWE-693

Prerequisites

• HTTP TRACE is enabled on the web server
• The destination system is susceptible to XSS or an adversary can leverage some other weakness to bypass the same origin policy
• Scripting is enabled in the client's browser
• HTTP is used as the communication protocol between the server and the client

Skills required

• Medium: Understanding of the HTTP protocol and an ability to craft a malicious script

Consequences

• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Gain Privileges
• Integrity: Modify Data

Mitigations

• Administrators should disable support for HTTP TRACE at the destination's web server. Vendors should disable TRACE by default.
• Patch web browser against known security origin policy bypass exploits.

Source

• MITRE CAPEC CAPEC-107