CAPEC Definitions

    CAPEC Definitions / CAPEC-182

    CAPEC-182: Flash Injection

    An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

    Severity:Medium
    Possibility:High

    Extended Description

    No Extended Description.

    Mitigations

    Implementation: remove sensitive information such as user name and password in the SWF file.

    Implementation: use validation on both client and server side.

    Implementation: remove debug information.

    Implementation: use SSL when loading external data

    Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

    Relationships with other CAPECs

    CAPEC-137: Parameter Injection

    CAPEC-248: Command Injection

    Prerequisites

    The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

    Related Weaknesses

    CWE-20: Improper Input Validation

    CWE-184: Incomplete List of Disallowed Inputs

    CWE-697: Incorrect Comparison