CAPEC-148: Content Spoofing

Overview

CAPEC-148 (Content Spoofing) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The target must provide content but fail to adequately protect it against modification.The adversary must have the means to alter data to which they are not authorized. If the content is to be modified in transit, the adversary must be able to intercept the targeted messages.

Resources required

If the content is to be modified in transit, the adversary requires a tool capable of intercepting the target's communication and generating/creating custom packets to impact the communications. In some variants, the targeted content is altered so that all or some of it is redirected towards content published by the attacker (for example, images and frames in the target's web site might be modified to be loaded from a source controlled by the attacker). In these cases, the attacker requires the necessary resources to host the replacement content.

Consequences

What a successful CAPEC-148 attack can achieve.

Modify Data

Affects: Integrity

A successful content spoofing attack compromises the integrity of the application data.

The CWE weaknesses that CAPEC-148 exploits.

CWE-345: Insufficient Verification of Data Authenticity

How this attack relates to others in the CAPEC hierarchy.

Child

Peer

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

Terminology & mappings

Mapped taxonomies

ATTACK: Defacement (1491)
WASC: Content Spoofing (12)
OWASP Attacks: Content Spoofing

Frequently asked questions

Common questions about CAPEC-148.

What is CAPEC-148?

An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.

What weaknesses does CAPEC-148 target?

CAPEC-148 exploits 1 CWE weakness, including CWE-345 (Insufficient Verification of Data Authenticity).

How severe is CAPEC-148?

MITRE rates CAPEC-148 as Medium severity with medium likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.