CAPEC-271 Schema Poisoning

An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target. Schemas provide the structure and content definitions for resources used by an application. By replacing or modifying a schema, the adversary can affect how the application handles or interprets a resource, often leading to possible denial of service, entering into an unexpected state, or recording incomplete data.

1. [Explore] [Find target application and schema] The adversary first finds the application that they want to target. This application must use schemas in some way, so the adversary also needs to confirm that schemas are being used. 2. [Experiment] [Gain access to schema] The adversary gains access to the schema so that they can modify the contents. 3. [Exploit] [Poison schema] Once the adversary gains access to the schema, they will alter it to achieve a desired effect. Locally, they can just modify the file. For remote schemas, the adversary will alter the schema in transit by performing an adversary in the middle attack.

• Some level of access to modify the target schema. • The schema used by the target application must be improperly secured against unauthorized modification and manipulation.

• Availability: Unreliable Execution, Resource Consumption • Integrity: Modify Data • Confidentiality: Read Data

• Design: Protect the schema against unauthorized modification. • Implementation: For applications that use a known schema, use a local copy or a known good repository instead of the schema reference supplied in the schema document. • Implementation: For applications that leverage remote schemas, use the HTTPS protocol to prevent modification of traffic in transit and to avoid unauthorized modification.