CAPEC Definitions

    CAPEC Definitions / CAPEC-388

    CAPEC-388: Application API Button Hijacking

    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.

    Severity:Medium
    Possibility:

    Extended Description

    No Extended Description.

    Mitigations

    No Mitigations found.

    Relationships with other CAPECs

    CAPEC-386: Application API Navigation Remapping

    Details

    Prerequisites

    Targeted software is utilizing application framework APIs

    Related Weaknesses

    CWE-471: Modification of Assumed-Immutable Data (MAID)

    Details

    CWE-345: Insufficient Verification of Data Authenticity

    Details

    CWE-346: Origin Validation Error

    Details

    CWE-602: Client-Side Enforcement of Server-Side Security

    Details

    CWE-311: Missing Encryption of Sensitive Data

    Details