CAPEC-141: Cache Poisoning

Description

An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.

Extended Description

Many applications allow users to send email messages by filling in fields. For example, a web site may have a link to "share this site with a friend" where the user provides the recipient's email address and the web application fills out all the other fields, such as the subject and body. In this pattern, an adversary adds header and body information to an email message by injecting additional content in an input field used to construct a header of the mail message. This attack takes advantage of the fact that RFC 822 requires that headers in a mail message be separated by a carriage return. As a result, an adversary can inject new headers or content simply by adding a delimiting carriage return and then supplying the new heading and body information. This attack will not work if the user can only supply the message body since a carriage return in the body is treated as a normal character.

Severity :

High

Possibility :

High

Type :

Standard

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-33: HTTP Request Smuggling HTTP Request Smuggling CAPEC-34: HTTP Response Splitting HTTP Response Splitting CAPEC-105: HTTP Request Splitting HTTP Request Splitting CAPEC-142: DNS Cache Poisoning DNS Cache Poisoning CAPEC-161: Infrastructure Manipulation Infrastructure Manipulation CAPEC-273: HTTP Response Smuggling HTTP Response Smuggling CAPEC-663: Exploitation of Transient Instruction Execution Exploitation of Transient Instruction Execution

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The attacker must be able to modify the value stored in a cache to match a desired value.
The targeted application must not be able to detect the illicit modification of the cache and must trust the cache value in its calculations.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Medium To overwrite/modify targeted cache

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

ATTACK | Adversary-in-the-Middle: ARP Cache Poisoning OWASP Attacks | Cache Poisoning

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-345: Insufficient Verification of Data Authenticity

CWE-346: Origin Validation Error

CWE-348: Use of Less Trusted Source

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Visit http://capec.mitre.org/ for more details.