CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
Last updated
Overview
CAPEC-22 (Exploiting Trust in Client) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- Server software must rely on client side formatted and validated values, and not reinforce these checks on the server side.
Skills required
- Medium skill: The attacker must have fairly detailed knowledge of the syntax and semantics of client/server communications protocols and grammars
Resources required
- Ability to communicate synchronously or asynchronously with server
Consequences
What a successful CAPEC-22 attack can achieve.
Execute Unauthorized Commands
Affects: Confidentiality, Integrity, Availability
Run Arbitrary Code
Gain Privileges
Affects: Confidentiality, Access Control, Authorization
Read Data
Affects: Confidentiality
How to mitigate it
Defenses that reduce the risk of CAPEC-22.