MetaSeverity: MediumCAPEC-212

CAPEC-212: Functionality Misuse

Description

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.

Likelihood of attack: Medium
Typical severity: Medium
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Abuse Existing Functionality

Prerequisites

The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes.

Skills required

LowGeneral computer knowledge about how applications are launched, how they interact with input/output, and how they are configured.

Consequences

Confidentiality
Gain Privileges
A successful attack of this kind can compromise the confidentiality of an authorized user's credentials.
ConfidentialityIntegrityAvailability
Other
Depending on the adversary's intended technical impact, a successful attack of this kind can compromise any or all elements of the security triad.

Mitigations

Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.
When implementing security features, consider how they can be misused and compromised.

Related weaknesses (CWE)

Related attack patterns

More specific patterns

Description

Consequences

Confidentiality

Gain Privileges

A successful attack of this kind can compromise the confidentiality of an authorized user's credentials.

ConfidentialityIntegrityAvailability

Other

Depending on the adversary's intended technical impact, a successful attack of this kind can compromise any or all elements of the security triad.

Mitigations

Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.

When implementing security features, consider how they can be misused and compromised.