Common Attack Pattern Enumeration and Classification

Common Attack Pattern Enumeration and Classification

An attacker embeds malicious scripts in content that will be served to web browsers.  The goal of the attack is for the target software, the client-side browser, to execute the script with the users’ privilege level.

An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect. As with all XSS attacks, there are a number of possible targets:
1. Launch attack on web browser clients and client machine
2. Launch attacks on client machines environment, such as LAN or Intranet
3. Launch attack on web server, including remote web servers

Web 2.0 technologies rely heavily on scripting, mashups of various remote content sources and other plug in technologies like multi media players which are effectively composed of content generated by other systems are vulnerable due to the fact that an attacker may use the HTTP header information that these technologies consume and display as an attack launch pad.

While Ajax and related Web 2.0 technologies are highly prized for rich client experience on web applications, they lack the ability to enforce security policy on the client side. The standard call for an Ajax application is XML HTTP Request (XHR), which by design limits its communication back to its URL host, however it is commonplace for developers to proxy communication from the host to other sites. In this case the client has no ability to 1) know that the communication is proxied in the first place and 2) know where the content is served from and 3) what intermediaries are involved who can sniff and tamper with data in transit.

Ajax does not necessarily introduce additional attack targets, but it does enhance the attacker's ability to execute attacks, probes, and enumerations, because Ajax client-server communications consist of numerous round trips. In classic XSS, the remote attacker may get only one chance to attempt an attack, and if she guesses wrong then needs to move on. In an Ajax scenario, it is likely the attacker can probe for multiple weaknesses, subnets, password combinations, and so on. The "lock" on the safe remains the same, but the attacker can try many combinations.

This lack of assurance on the client side opens up two main vectors for attackers, 1) the attacker can push code to launch attacks on the client system or network, and 2) the attacker can lure the client to malicious sites and to asserting information such as authentication or personal data to the malicious site.

Classic phishing attacks lure users to click on content that appears trustworthy, such as logos, and links that seem to go to their trusted financial institutions and online auction sites. But instead the attacker appends malicious scripts into the otherwise innocent appearing resources. The HTML source for a standard phishing attack looks like this

<a href="www.exampletrustedsite.com?Name=<script>maliciousscript</script>">Trusted Site</a>

When the user clicks the link, the appended script also executes on the local user's machine.