CAPEC Details
Name Application API Message Manipulation via Man-in-the-Middle
Likelyhood of attack Typical severity
High Low
Summary An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
Prerequisites Targeted software is utilizing application framework APIs
Solutions
Related Weaknesses
CWE ID Description
CWE-311 Missing Encryption of Sensitive Data
CWE-345 Insufficient Verification of Data Authenticity
CWE-346 Origin Validation Error
CWE-471 Modification of Assumed-Immutable Data (MAID)
CWE-602 Client-Side Enforcement of Server-Side Security
Related CAPECS
CAPEC ID Description
CAPEC-94 An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first flows through the adversary, who has the opportunity to observe or alter it, before being passed on to the intended recipient as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for these attacks yields an implicit lack of trust in communication or identify between two components. These attacks differ from Sniffing Attacks (CAPEC-157) since these attacks often modify the communications prior to delivering it to the intended recipient.