An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.
High
Medium

1
Explore
[Find Injection Entry Points] The attacker first takes an inventory of the entry points of the application.
Spider the website for all available URLs that reference a Flash application.
List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies.

2
Experiment
[Determine the application's susceptibility to Flash injection] Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.
Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg
Test the page using controlled evil page/host, http://example.com/evil.swf
Test the page using Flash HTML injection, "'><img src='asfunction:getURL,javascript:gotRoot("")//.jpg' >
Test the page using DOM injection, (gotRoot(''))

3
Exploit
[Inject malicious content into target] Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.

Confidentiality
Other
Information Leakage

Integrity
Modify Data

Confidentiality
Read Data

Authorization
Execute Unauthorized Commands
Run Arbitrary Code

Accountability
Authentication
Authorization
Non-Repudiation
Gain Privileges

Access Control
Authorization
Bypass Protection Mechanism

Implementation: remove sensitive information such as user name and password in the SWF file.
Implementation: use validation on both client and server side.
Implementation: remove debug information.
Implementation: use SSL when loading external data
Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

In the following example, the SWF file contains
getURL('javascript:SomeFunc("someValue")','','GET')
A request like
http://example.com/noundef.swf?a=0:0;alert('XSS')
becomes
javascript:SomeFunc("someValue")?a=0:0;alert(123)

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attacker_Skills_or_Knowledge_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Consequences

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances