CAPEC-182 Flash Injection

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

1. [Explore] [Find Injection Entry Points] The attacker first takes an inventory of the entry points of the application. 2. [Experiment] [Determine the application's susceptibility to Flash injection] Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection. 3. [Exploit] [Inject malicious content into target] Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

• The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

• [Medium] The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

• Confidentiality: Other • Integrity: Modify Data • Confidentiality: Read Data • Authorization: Execute Unauthorized Commands • Accountability, Authentication, Authorization, Non-Repudiation: Gain Privileges • Access Control, Authorization: Bypass Protection Mechanism

• Implementation: remove sensitive information such as user name and password in the SWF file. • Implementation: use validation on both client and server side. • Implementation: remove debug information. • Implementation: use SSL when loading external data • Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.