CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

MITRE CAPEC attack pattern

Description

This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-287, CWE-300, CWE-693

ATT&CK techniques: T1040

Prerequisites

• Opportunity to intercept must exist beyond the point where SSL is terminated.
• The adversary must be able to insert a listener actively (proxying the communication) or passively (sniffing the communication) in the client-server communication path.

Skills required

• Low: To insert a network sniffer or other listener into the communication stream

Consequences

• Confidentiality, Access Control, Authorization: Gain Privileges

Mitigations

• Implementation: Implement message level security such as HMAC in the HTTP communication
• Design: Utilize defense in depth, do not rely on a single security mechanism like SSL
• Design: Enforce principle of least privilege

Source

• MITRE CAPEC CAPEC-57