CAPEC-182:Flash Injection
Attack Pattern ID:182
Version:v3.9
Attack Pattern Name:Flash Injection
Abstraction:Standard
Status:Draft
Likelihood of Attack:High
Typical Severity:Medium
▼Description
An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.
▼Extended Description
▼Alternate Terms
▼Relationships
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 137 | Parameter Injection |
| ParentOf | D | 174 | Flash Parameter Injection |
| ParentOf | D | 178 | Cross-Site Flashing |
| CanAlsoBe | M | 248 | Command Injection |
▼Execution Flow
Explore
1.
Find Injection Entry Points
The attacker first takes an inventory of the entry points of the application.
| Technique |
|---|
| Spider the website for all available URLs that reference a Flash application. |
| List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies. |
Experiment
1.
Determine the application's susceptibility to Flash injection
Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.
| Technique |
|---|
| Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg |
| Test the page using controlled evil page/host, http://example.com/evil.swf |
Test the page using Flash HTML injection, "'>![](asfunction:getURL,javascript:gotRoot("")//.jpg) |
| Test the page using DOM injection, (gotRoot('')) |
Exploit
1.
Inject malicious content into target
Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase
| Technique |
|---|
▼Prerequisites
The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.
▼Skills Required
Medium
The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.
▼Resources Required
None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.
▼Indicators
▼Consequences
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Confidentiality | N/A | Other | Information Leakage |
| Integrity | N/A | Modify Data | N/A |
| Confidentiality | N/A | Read Data | N/A |
| Authorization | N/A | Execute Unauthorized Commands | Run Arbitrary Code |
| AccountabilityAuthenticationAuthorizationNon-Repudiation | N/A | Gain Privileges | N/A |
| Access ControlAuthorization | N/A | Bypass Protection Mechanism | N/A |
Scope: Confidentiality
Likelihood: N/A
Impact: Other
Note: Information Leakage
Scope: Integrity
Likelihood: N/A
Impact: Modify Data
Note: N/A
Scope: Confidentiality
Likelihood: N/A
Impact: Read Data
Note: N/A
Scope: Authorization
Likelihood: N/A
Impact: Execute Unauthorized Commands
Note: Run Arbitrary Code
Scope: Accountability, Authentication, Authorization, Non-Repudiation
Likelihood: N/A
Impact: Gain Privileges
Note: N/A
Scope: Access Control, Authorization
Likelihood: N/A
Impact: Bypass Protection Mechanism
Note: N/A
▼Mitigations
Implementation: remove sensitive information such as user name and password in the SWF file.
Implementation: use validation on both client and server side.
Implementation: remove debug information.
Implementation: use SSL when loading external data
Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.
▼Example Instances
▼Related Weaknesses
▼Taxonomy Mappings
| Taxonomy Name | Entry ID | Entry Name |
|---|
▼Notes
▼References
Reference ID: REF-46
Title: Finding Vulnerabilities in Flash Applications
Author: Stefano Di Paola
Publication:
OWASP Appsec 2007
Publisher:
Edition:
URL:
URL Date:
Day:15
Month:11
Year:2007
Reference ID: REF-47
Title: A Lazy Pen Tester's Guide to Testing Flash Applications
Author: Rudra K. Sinha Roy
Publication:
iViz
Publisher:
Edition:
URL Date:
Day:N/A
Month:N/A
Year:N/A
Reference ID: REF-48
Title: Creating More Secure SWF Web Application
Author: Peleus Uhley
Publication:
Publisher:Adobe Systems Incorporated
Edition:
URL Date:
Day:N/A
Month:N/A
Year:N/A
Details not found