CAPEC-587: Cross Frame Scripting (XFS)

MITRE CAPEC attack pattern

Description

This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-1021

Prerequisites

• The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.

Consequences

• Confidentiality: Read Data

Mitigations

• Avoid clicking on untrusted links.
• Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.

Source

• MITRE CAPEC CAPEC-587