New to CAPEC? Start Here
Home > CAPEC List > CAPEC-178: Cross-Site Flashing (Version 3.9)  

CAPEC-178: Cross-Site Flashing

Attack Pattern ID: 178
Abstraction: Detailed
View customized information:
+ Description
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.
+ Likelihood Of Attack

Medium

+ Typical Severity

Medium

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.182Flash Injection
CanFollowDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.174Flash Parameter Injection
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
View NameTop Level Categories
Domains of AttackSoftware, Social Engineering
Mechanisms of AttackInject Unexpected Items
+ Execution Flow
Explore

  1. Identification: Using a browser or an automated tool, an attacker records all instances of URLs (or partial URL such as domain) passed to a flash file (SWF).

    Techniques
    Use an automated tool to record the variables passed to a flash file.
    Use a browser to manually explore the website and analyze how the flash file receive variables, e.g. JavaScript using SetVariable/GetVariable, HTML FlashVars param tag, etc.
    Use decompilers to retrieve the flash source code and record all user-controllable variables passed to a loadMovie* directive.
Experiment

  1. Attempt to inject a remote flash file: The attacker makes use of a remotely available flash file (SWF) that generates a uniquely identifiable output when executed inside the targeted flash file.

    Techniques
    Modify the variable of the SWF file that contains the remote movie URL to the attacker controlled flash file.
Exploit

  1. Access or Modify Flash Application Variables: As the attacker succeeds in exploiting the vulnerability, they target the content of the flash application to steal variable content, password, etc.

    Techniques
    Develop malicious Flash application that is injected through vectors identified during the Experiment Phase and loaded by the victim browser's flash plugin and sends document information to the attacker.
    Develop malicious Flash application that is injected through vectors identified during the Experiment Phase and takes commands from an attacker's server and then causes the flash application to execute appropriately.

  2. Execute JavaScript in victim's browser: When the attacker targets the current flash application, they can choose to inject JavaScript in the client's DOM and therefore execute cross-site scripting attack.

    Techniques
    Develop malicious JavaScript that is injected from the rogue flash movie to the targeted flash application through vectors identified during the Experiment Phase and loaded by the victim's browser.
+ Prerequisites
The targeted Flash application must reference external URLs and the locations thus referenced must be controllable through parameters. The Flash application must fail to sanitize such parameters against malicious manipulation. The victim must follow a crafted link created by the attacker.
+ Skills Required
[Level: Medium]
knowledge of Flash internals, parameters and remote referencing.
+ Consequences
Section HelpThis table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
ScopeImpactLikelihood
Integrity
Modify Data
Confidentiality
Read Data
Authorization
Execute Unauthorized Commands
Accountability
Authentication
Authorization
Non-Repudiation
Gain Privileges
Access Control
Authorization
Bypass Protection Mechanism
+ Mitigations
Implementation: Only allow known URL to be included as remote flash movies in a flash application
Configuration: Properly configure the crossdomain.xml file to only include the known domains that should host remote flash movies.
+ Example Instances
The attacker tries to get their malicious flash movie to be executed in the targeted flash application. The malicious file is hosted on the attacker.com domain and the targeted flash application is hosted on example.com The crossdomain.xml file in the root of example.com allows all domains and no specific restriction is specified in the targeted flash application. When the attacker injects their malicious file in the vulnerable flash movie, the rogue flash application is able to access internal variables and parameter of the flash movie.
+ References
[REF-41] Stefano Di Paola. "Testing Flash Applications". 2007. <http://www.wisec.it/en/Docs/flash_App_testing_Owasp07.pdf>.
[REF-42] "OWASP Web Security Testing Guide". Testing for Cross site flashing. The Open Web Application Security Project (OWASP). <https://www.owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/08-Testing_for_Cross_Site_Flashing.html>.
[REF-561] "Cross-Site Flashing". Trustwave. <http://doc.cenzic.com/sadoc9x14ba847/CPL0001509.htm>.
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23
(Version 2.6)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2019-04-04
(Version 3.1)
CAPEC Content TeamThe MITRE Corporation
Updated Consequences, References
2020-07-30
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Example_Instances, Execution_Flow
2020-12-17
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated References
2023-01-24
(Version 3.9)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Weaknesses
More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2018
 

Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2026, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.
Morty Proxy This is a proxified and sanitized view of the page, visit original site.