CAPEC-182: Flash Injection

MITRE CAPEC attack pattern

Description

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-20, CWE-184, CWE-697

Prerequisites

• The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

Skills required

• Medium: The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

Consequences

• Confidentiality: Other
• Integrity: Modify Data
• Confidentiality: Read Data
• Authorization: Execute Unauthorized Commands
• Accountability, Authentication, Authorization, Non-Repudiation: Gain Privileges
• Access Control, Authorization: Bypass Protection Mechanism

Mitigations

• Implementation: remove sensitive information such as user name and password in the SWF file.
• Implementation: use validation on both client and server side.
• Implementation: remove debug information.
• Implementation: use SSL when loading external data
• Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

Source

• MITRE CAPEC CAPEC-182