CAPEC-466 Metadata
Likelihood of Attack
High
Typical Severity
Medium
Overview
Summary
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.
Prerequisites
The victim and the attacker are both in an environment where an active adversary in the middle attack is possible (e.g., public WIFI hot spot)The victim visits at least one website that does not use TLS / SSL
Potential Solutions / Mitigations
Design: Tunnel communications through a secure proxy Design: Trust level separation for privileged / non privileged interactions (e.g., two different browsers, two different users, two different operating systems, two different virtual machines)
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-300 | Channel Accessible by Non-Endpoint |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-94 | An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.