WS-Addressing is used to virtualize services, provide return addresses and other routing information, however, unless the WS-Addressing headers are protected they are vulnerable to rewriting. Content in a registry is deployed by the service provider. The registry in an SOA or Web Services system can be accessed by the service requester via UDDI or other protocol.
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 203 | Manipulate Registry Information |
Find a target SOA or Web Service
The adversary must first indentify a target SOA or Web Service.
| Technique |
|---|
Determine desired outcome
Because poisoning a web service registry can have different outcomes, the adversary must decide how they wish to effect the webservice.
| Technique |
|---|
| An adversary can perform a denial of service attack on a web service. |
| An adversary can redirect requests or responses to a malicious service. |
Determine if a malicious service needs to be created
If the adversary wishes to redirect requests or responses, they will need to create a malicious service to redirect to.
| Technique |
|---|
| Create a service to that requests are sent to in addition to the legitimate service and simply record the requests. |
| Create a service that will give malicious responses to a service provider. |
| Act as a malicious service provider and respond to requests in an arbitrary way. |
Poison Web Service Registry
Based on the desired outcome, poison the web service registry. This is done by altering the data at rest in the registry or uploading malicious content by spoofing a service provider.
| Technique |
|---|
| Intercept and change WS-Adressing headers to route to a malicious service or service provider. |
| Provide incorrect information in schema or metadata to cause a denial of service. |
| Delete information about service procider interfaces to cause a denial of service. |
To identify and execute against an over-privileged system interface
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrityAvailability | N/A | Execute Unauthorized Commands | Run Arbitrary Code |
| Confidentiality | N/A | Read Data | N/A |
| Integrity | N/A | Modify Data | N/A |
| Taxonomy Name | Entry ID | Entry Name |
|---|