Matching CACSSaS

URI: MP-CACSSaS

Package: ProcessComms

< prev | next >

Description: Finds a channel between a client and a service used to pass authorization tokens, and a second channel from the service to another service used to validate those tokens, along with the hosts of the client and the second service, plus optionally the client user and the managers of the second service and its host.

Root Pattern: R-CACSSaS

R-CACSSaS

Finds a channel between a client and a service used to pass authorization tokens, and a second channel from the service to another service used to validate those tokens, along with the hosts of the client and the second service.

Threat Patterns (2)

CC.AuC.CACSSaS.3.2

Spoofed authorization service Service allows impersonation of Client to Process: if service Process redirects clients to service Service for authentication, and sends the client credentials to Service for validation, then if an attacker can impersonate Service to Process can falsely validate fake client credentials. Note that this does not necessarily mean they can access Process as Client, only that the client credentials are compromised. The fake token also does not give the attacker rights to other services used by Process.

CC.AX.CACSSaS.0

Client Client unable to access service Process because Process cannot access authorization service Service: the service Process requires that clients authenticate with a separate service Service, but Process cannot access Service to exchange the client token issued by Service for an access token granting rights at Process.