Home > CAPEC List > CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy (Version 3.9)

CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy

Attack Pattern ID: 466
Abstraction: Standard
View customized information:
Description
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.
Extended Description

When an attacker intercepts a response bound to the victim, an attacker adds an iFrame (which is possibly invisible) to the response referencing some domain with sensitive functionality and forwards the response to the victim. The victim's browser than automatically initiates an unauthorized request to the site with sensitive functionality. The same origin policy would prevent making these requests to a site other than the one from which the Java Script came, but the attacker once again uses active adversary in the middle to intercept these automatic requests and redirect them to the domain / service with sensitive functionality. Any persistent cookies that the victim has in their browser would be used for these unauthorized requests. The attacker thus actively directs the victim to a site with sensitive functionality. When the site with sensitive functionality responds back to the victim's request, an active adversary in the middle attacker intercepts these responses, injects their own malicious Java Script into these responses, and forwards to the victim's browser. In the victim's browser, that Java Script executes under the restrictions of the site with sensitive functionality and can be used to continue to interact with the sensitive site. So an attacker can execute scripts within the victim's browser on any domains the attacker desires. The attacker is able to use this technique to steal cookies from the victim's browser for whatever site the attacker wants. This applies to both persistent cookies and HTTP only cookies (unlike traditional XSS attacks). An attacker is also able to use this technique to steal authentication credentials for sites that only encrypt the login form, but do not require a secure channel for the initial request to get to the page with the login form. Further the attacker is also able to steal any autocompletion information. This attack pattern can also be used to enable session fixation and cache poisoning attacks. Additional attacks can be enabled as well.

Typical Severity

Medium

Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.94Adversary in the Middle (AiTM)
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
Prerequisites
The victim and the attacker are both in an environment where an active adversary in the middle attack is possible (e.g., public WIFI hot spot)The victim visits at least one website that does not use TLS / SSL
Skills Required
[Level: Low]
Ability to intercept and modify requests / responses
[Level: Medium]
Ability to create iFrame and JavaScript code that would initiate unauthorized requests to sensitive sites from the victim's browser
[Level: Medium]
Solid understanding of the HTTP protocol
Consequences
Section HelpThis table specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
ScopeImpactLikelihood
Confidentiality
Read Data
Authorization
Execute Unauthorized Commands
Mitigations
Design: Tunnel communications through a secure proxy
Design: Trust level separation for privileged / non privileged interactions (e.g., two different browsers, two different users, two different operating systems, two different virtual machines)
Taxonomy Mappings
Section HelpCAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.
Relevant to the ATT&CK taxonomy mapping (see parent )
References
[REF-403] Roi Saltzman and Adi Sharabani. "Active Man in the Middle Attacks". IBM Rational Application Security Group. 2009年02月02日. <http://blog.watchfire.com/wfblog/2009/02/active-man-in-the-middle-attacks.html>.
Content History
Submissions
Submission DateSubmitterOrganization
2014年06月23日
(Version 2.6)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2019年09月30日
(Version 3.2)
CAPEC Content TeamThe MITRE Corporation
Updated @Abstraction
2020年07月30日
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Description
2020年12月17日
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated Consequences, Description, Mitigations
2021年06月24日
(Version 3.5)
CAPEC Content TeamThe MITRE Corporation
Updated @Name, Description, Prerequisites
2022年02月22日
(Version 3.7)
CAPEC Content TeamThe MITRE Corporation
Updated Description, Extended_Description
Previous Entry Names
Change DatePrevious Entry Name
2021年06月24日
(Version 3.5)
Leveraging Active Man in the Middle Attacks to Bypass Same Origin Policy
More information is available — Please select a different filter.
Page Last Updated or Reviewed: June 24, 2021

Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.

AltStyle によって変換されたページ (->オリジナル) /