CAPEC-389: Content Spoofing Via Application API Manipulation
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the attackers' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the attackers' intent. The techniques require use of specialized software that allow the attacker to use adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system.
Last updated
Overview
CAPEC-389 (Content Spoofing Via Application API Manipulation) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- Targeted software is utilizing application framework APIs
Resources required
- A software program that allows the use of adversary-in-the-middle communications between the client and server, such as an adversary-in-the-middle proxy.
Frequently asked questions
Common questions about CAPEC-389.
- What is CAPEC-389?
- An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the attackers' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the attackers' intent. The techniques require use of specialized software that allow the attacker to use adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system.
- What weaknesses does CAPEC-389 target?
- CAPEC-389 exploits 1 CWE weakness, including CWE-353 (Missing Support for Integrity Check).
- How severe is CAPEC-389?
- MITRE rates CAPEC-389 as Low severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-389
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.