auren-research/cyber-sec huggingface dataset:
An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.

Due to open-source software's popularity, it serves as a desirable attack-vector for adversaries since a single malicious component may result in the exploitation of numerous systems/applications. Adversaries may, therefore, spoof the metadata pertaining to the open-source software in order to trick victims into downloading and using their malicious software. Examples of metadata that may be spoofed include:

Owner of the software (e.g., repository or package owner)
Author(s) of repository commits
Frequency of repository commits
Date/Time of repository commits
Package or Repository "stars"

Once the malicious software component has been integrated into an underlying application or executed on a system, the adversary is ultimately able to achieve numerous negative technical impacts within the system/application. This often occurs without any indication of compromise.

Medium
High

Identification of a popular open-source component whose metadata is to be spoofed.

Ability to spoof a variety of software metadata to convince victims the source is trusted.

Integrity
Modify Data

Accountability
Hide Activities

Access Control
Authorization
Execute Unauthorized Commands
Alter Execution Logic
Gain Privileges

Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged.
Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
Reference vulnerability databases to determine if the software contains known vulnerabilities.
Only download open-source software from reputable hosting sites or package managers.
Only download open-source software that has been adequately signed by the developer(s). For repository commits/tags, look for the "Verified" status and for developers leveraging "Vigilant Mode" (GitHub) or similar modes.
After downloading open-source software, ensure integrity values have not changed.
Before executing or incorporating the software, leverage automated testing techniques (e.g., static and dynamic analysis) to determine if the software behaves maliciously.

An adversary provides a malicious open-source library, claiming to provide extended logging features and functionality, and spoofs the metadata with that of a widely used legitimate library. The adversary then tricks victims into including this library in their underlying application. Once the malicious software is incorporated into the application, the adversary is able to manipulate and exfiltrate log data.

1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools

1195.002
Supply Chain Compromise: Compromise Software Supply Chain

CAPEC Content Team
The MITRE Corporation
2022-09-29
An adversary collects information about the target system in an attempt to identify the system's geographical location.
Information gathered could include keyboard layout, system language, and timezone. This information may benefit an adversary in confirming the desired target and/or tailoring further attacks.

High
Very Low

1
Explore
[System Locale Information Discovery] The adversary examines system information from various sources such as registry and native API functions and correlates the gathered information to infer the geographical location of the target system
Registry Query: Query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Language\Language_Dialect on Windows to obtain system language, Computer\HKEY_CURRENT_USER\Keyboard Layout\Preload to obtain the hexadecimal language IDs of the current user's preloaded keyboard layouts, and Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation to obtain the system timezone configuration
Native API Requests: Parse the outputs of Windows API functions GetTimeZoneInformation, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID to obtain information about languages, keyboard layouts, and timezones installed on the system or on macOS or Linux systems, query locale to obtain the $LANG environment variable and view keyboard layout information or use timeanddatectl status to show the system clock settings.
Read Configuration Files: For macOS and Linux-based systems, view the /etc/vconsole.conf file to get information about the keyboard mapping and console font.

The adversary must have some level of access to the system and have a basic understanding of the operating system in order to query the appropriate sources for relevant information.

The adversary must know how to query various system sources of information respective of the system's operating system to obtain the relevant information.

The adversary requires access to the target's operating system tools to query relevant system information. On windows, registry queries can be conducted with powershell, wmi, or regedit. On Linux or macOS, queries can be performed with through a shell.

Confidentiality
Read Data

To reduce the amount of information gathered, one could disable various geolocation features of the operating system not required for system operation.

1614
System Language Discovery

CAPEC Content Team
The MITRE Corporation
2022-09-29
An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP.

DHCP is broadcast to the entire Local Area Network (LAN) and does not have any form of authentication by default. Therefore, it is susceptible to spoofing.
An adversary with access to the target LAN can receive DHCP messages; obtaining the topology information required to potentially manipulate other hosts' network configurations.
To improve the likelihood of the DHCP request being serviced by the Rogue server, an adversary can first starve the DHCP pool.

Low
High

1
Explore
[Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.
Adversary observes LAN traffic for DHCP solicitations

2
Experiment
[Capture the DHCP DISCOVER message] The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.
Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.

3
Exploit
[Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.
Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.

The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.

The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.

The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.

Confidentiality
Access Control
Read Data

Integrity
Access Control
Modify Data
Execute Unauthorized Commands

Availability
Resource Consumption

Design: MAC-Forced Forwarding
Implementation: Port Security and DHCP snooping
Implementation: Network-based Intrusion Detection Systems

In early 2019, Microsoft patched a critical vulnerability (CVE-2019-0547) in the Windows DHCP client which allowed remote code execution via crafted DHCP OFFER packets. [REF-739]

1557.003
Adversary-in-the-Middle: DHCP Spoofing

CAPEC Content Team
The MITRE Corporation
2022-09-29
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.

Unlike Adversary in the Browser, the victim does not need to install a malicious application. Browser in the Middle uses the inherent functionalities of a web browser to convince the victim they are browsing normally under the assumption that the connection is secure. All the actions performed by the victim in the open window are actually performed on the machine of the adversary. These victim-authenticated sessions are available to the adversary to use. All entered data such as passwords and usernames can be logged by the adversary and the content displayed to the victim can be altered arbitrarily. Varieties of multifactor authentication which rely solely on user input and do not use a form of hardware-based secret exchange are vulnerable to browser in the middle.

Medium
High

1
Explore
[Identify potential targets] The adversary identifies an application or service that the target is likely to use.
The adversary stands up a server to host the transparent browser and entices victims to use it by using a domain name similar to the legitimate application. In addition to the transparent browser, the adversary could also install a web proxy, sniffer, keylogger, and other tools to assist in their goals.

2
Experiment
[Lure victims] The adversary crafts a phishing campaign to lure unsuspecting victims into using the transparent browser.
An adversary can create a convincing email with a link to download the web client and interact with the transparent browser.

3
Exploit
[Monitor and Manipulate Data] When the victim establishes the connection to the transparent browser, the adversary can view victim activity and make alterations to what the victim sees when browsing the web.
Once a victim has established a connection to the transparent browser, the adversary can use installed tools such as a web proxy, keylogger, or additional malicious browser extensions to gather and manipulate data or impersonate the victim.

The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local authentication APIs, a hardware token, or a Trusted Platform Module (TPM) to authenticate.

A web application with a client is needed to enable the victim's browser to establish a remote desktop connection to the system of the adversary.

Confidentiality
Access Control
Authentication
Gain Privileges
High

Confidentiality
Authorization
Read Data
High

Integrity
Modify Data
Medium

Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel

Jonas Tzschoppe
Nuremberg Institute of Technology
2023-01-24
An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to pass and exploit these vulnerabilities.
High
High

The victim must trust the name and locale of user controlled filenames.

To achieve a redirection and use of less trusted source, an attacker can simply edit data that the host uses to build the filename
Deploying a malicious "look-a-like" site (such as a site masquerading as a bank or online auction site) that the user enters their authentication data into.
Exploiting a client side vulnerability to inject malicious scripts into the browser's executable process.

Confidentiality
Access Control
Authorization
Gain Privileges

Confidentiality
Integrity
Availability
Execute Unauthorized Commands
Run Arbitrary Code

Availability
Alter Execution Logic

Confidentiality
Read Data

Design: Use browser technologies that do not allow client side scripting.
Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.
Implementation: Perform input validation for all remote content.
Implementation: Perform output validation for all remote content.
Implementation: Disable scripting languages such as JavaScript in browser
Implementation: Scan dynamically generated content against validation specification

Phishing attacks rely on a user clicking on links on that are supplied to them by attackers masquerading as a trusted resource such as a bank or online auction site. The end user's email client hosts the supplied resource name in this case via email. The resource name, however may either 1) direct the client browser to a malicious site to steal credentials and/or 2) execute code on the client machine to probe the victim's host system and network environment.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Description Summary, Related_Attack_Patterns
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
High
Very High

Configuration files must be modifiable by the attacker

To identify vulnerable configuration files, and understand how to manipulate servers and erase forensic evidence

Confidentiality
Access Control
Authorization
Gain Privileges

Design: Enforce principle of least privilege
Design: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD

The BEA Weblogic server uses a config.xml file to store configuration data. If this file is not properly protected by the system access control, an attacker can write configuration information to redirect server output through system logs, database connections, malicious URLs and so on. Access to the Weblogic server may be from a so-called Custom realm which manages authentication and authorization privileges on behalf of user principals. Given write access, the attacker can insert a pointer to a custom realm jar file in the config.xml
< CustomRealmConfigurationData="java.util.Properties"Name="CustomRealm"RealmClassName="Maliciousrealm.jar"/>

The main issue with configuration files is that the attacker can leverage all the same functionality the server has, but for malicious means. Given the complexity of server configuration, these changes may be very hard for administrators to detect.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances
This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads, CAPEC-231: XML Oversized Payloads, and CAPEC-147: XML Ping of Death. Please refer to these CAPECs going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Name, @Status, Consequences, Description, Example_Instances, Likelihood_Of_Attack, Mitigations, Prerequisites, Related_Weaknesses, Skills_Required, Typical_Severity

Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.
High
Low

1
Explore
[Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HTML to identify any known underlying JavaScript architectures. This can aid in mappiong publicly known vulnerabilities to the webpage and can also helpo the adversary guess application architecture and the inner workings of a system.
Record all "src" values inside script tags. These JavaScript files are compared to lists of files for known architectures. If there is a large match between the "src" values and architecture files, then it can be assumed that particular architecture is being used.

The user must allow JavaScript to execute in their browser

To land and launch a script on victim's machine with appropriate footprinting logic for enumerating services and vulnerabilities in JavaScript

None: No specialized resources are required to execute this type of attack.

Confidentiality
Read Data

Design: Use browser technologies that do not allow client side scripting.
Implementation: Perform input validation for all remote content.

Footprinting can be executed over almost any protocol including HTTP, TCP, UDP, and ICMP, with the general goal of gaining further information about a host environment to launch further attacks. The attacker can probe the system for banners, vulnerabilities, filenames, available services, and in short anything the host process has access to. The results of the probe are either used to execute javascript (for example, if the attackers' footprint script identifies a vulnerability in a firewall permission, then the client side script executes a javascript to change client firewall settings, or an attacker may simply echo the results of the scan back out to a remote host for targeting future attacks) or to inform other data gathering activities in order to craft atta.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated References

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Description, Example_Instances, Execution_Flow, Mitigations, Related_Attack_Patterns, Resources_Required, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated @Name, Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Execution_Flow

AJAX Fingerprinting
This attack pattern has been deprecated as it is contained in the existing attack pattern "CAPEC-18 : XSS Targeting Non-Script Elements". Please refer to this other CAPEC going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Architectural_Paradigms, Attack_Motivation-Consequences, Attack_Phases, Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, CIA_Impact, Description, Description Summary, Examples-Instances, Frameworks, Injection_Vector, Languages, Methods_of_Attack, Payload, Payload_Activation_Impact, Platforms, Purposes, Related_Attack_Patterns, Related_Guidelines, Related_Security_Principles, Related_Vulnerabilities, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Technical_Context, Typical_Likelihood_of_Exploit, Typical_Severity

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description Summary

XSS in IMG Tags
An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. It is possible that the application does not handle situations properly where access to these libraries has been blocked. Depending on the error handling within the application, blocked access to libraries may leave the system in an insecure state that could be leveraged by an attacker.
Medium
Medium

1
Explore
Determine what external libraries the application accesses.

2
Experiment
Block access to the external libraries accessed by the application.

3
Experiment
Monitor the behavior of the system to see if it goes into an insecure/inconsistent state.

4
Experiment
If the system does go into an insecure/inconsistent state, leverage that to obtain information about the system functionality or data, elevate access control, etc. The rest of this attack will depend on the context and the desired goal.

An application requires access to external libraries.
An attacker has the privileges to block application access to external libraries.

Knowledge of how to block access to libraries, as well as knowledge of how to leverage the resulting state of the application based on the failed call.

Availability
Alter Execution Logic

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism

Ensure that application handles situations where access to APIs in external libraries is not available securely. If the application cannot continue its execution safely it should fail in a consistent and secure fashion.

A web-based system uses a third party cryptographic random number generation library that derives entropy from machine's hardware. This library is used in generation of user session ids used by the application. If the library is inaccessible, the application instead uses a software based weak pseudo random number generation library. An attacker of the system blocks access of the application to the third party cryptographic random number generation library (by renaming it). The application in turn uses the weak pseudo random number generation library to generate session ids that are predictable. An attacker then leverages this weakness to guess a session id of another user to perform a horizontal elevation of privilege escalation and gain access to another user's account.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-01-09
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attacker_Skills_or_Knowledge_Required

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Related_Weaknesses
This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads and CAPEC-231: XML Oversized Payloads. Please refer to these CAPECs going forward.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Name, @Status, Consequences, Description, Example_Instances, Execution_Flow, Indicators, Likelihood_Of_Attack, Mitigations, Prerequisites, References, Related_Attack_Patterns, Related_Weaknesses, Skills_Required, Typical_Severity

XML Parser Attack