CAPECattack pattern

CAPEC-388 Application API Button Hijacking

Medium Official page ↗
Abstraction
Detailed
Status
Draft
Typical severity
Medium
CAPEC version
3.9

Description

An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.

Prerequisites

• Targeted software is utilizing application framework APIs

Related

Child of · CAPEC (1)

  • CAPEC-386 Application API Navigation Remapping attack pattern

Weakness · CWE (5)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-346 Origin Validation Error weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness
  • CWE-602 Client-Side Enforcement of Server-Side Security weakness

Referenced by CWE · attack pattern (5)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-346 Origin Validation Error weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness
  • CWE-602 Client-Side Enforcement of Server-Side Security weakness