List attack patterns

curl "https://radicalnotion.ai/api/v1/capecs?q=deserial" \
  -H "Authorization: Bearer $RN_TOKEN"

{
  "data": [
    {
      "capec_id": 586,
      "capec_id_string": "CAPEC-586",
      "name": "Object Injection",
      "abstraction": "Meta",
      "status": "Draft",
      "description": "An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.",
      "likelihood_of_attack": "Medium",
      "typical_severity": "High",
      "prerequisites": [
        "The target application must unserialize data before validation."
      ],
      "skills_required": [],
      "resources_required": [],
      "consequences": [
        {
          "scopes": [
            "Availability"
          ],
          "impacts": [
            "Resource Consumption"
          ],
          "note": "If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate and exhaust available resources."
        },
        {
          "scopes": [
            "Integrity"
          ],
          "impacts": [
            "Modify Data"
          ],
          "note": "Attackers can modify objects or data that was assumed to be safe from modification."
        },
        {
          "scopes": [
            "Authorization"
          ],
          "impacts": [
            "Execute Unauthorized Commands"
          ],
          "note": "Functions that assume information in the deserialized object is valid could be exploited."
        }
      ],
      "mitigations": [
        "Implementation: Validate object before deserialization process",
        "Design: Limit which types can be deserialized.",
        "Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes.",
        "Implementation: Keep session state on the server, when possible."
      ],
      "execution_flow": [],
      "related_weaknesses": [
        {
          "id": "cwe-502",
          "display": "CWE-502",
          "name": "Deserialization of Untrusted Data"
        }
      ],
      "related_attack_patterns": []
    }
  ],
  "pagination": {
    "limit": 25,
    "next_cursor": null
  }
}