CAPEC-179: Calling Micro-Services Directly
Description
An attacker is able to discover and query Micro-services at a web location and thereby expose the Micro-services to further exploitation by gathering information about their implementation and function. Micro-services in web pages allow portions of a page to connect to the server and update content without needing to cause the entire page to update. This allows user activity to change portions of the page more quickly without causing disruptions elsewhere.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The target site must use micro-services that interact with the server and one or more of these micro-services must be vulnerable to some other attack pattern.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.