CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
Description
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
- Likelihood of attack
- Medium
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- Opportunity to intercept must exist beyond the point where SSL is terminated.
- The adversary must be able to insert a listener actively (proxying the communication) or passively (sniffing the communication) in the client-server communication path.
Skills required
- LowTo insert a network sniffer or other listener into the communication stream
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Implementation: Implement message level security such as HMAC in the HTTP communication
- Design: Utilize defense in depth, do not rely on a single security mechanism like SSL
- Design: Enforce principle of least privilege
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.