Matching CACSScS

URI: MP-CACSScS

Description: Finds a channel between a client and a service, where authentication on this channel is controlled by authentication on another channel from the same client to a second service, along with the hosts of the client and the second service, plus optionally the client user and the managers of the second service and its host.

Root Pattern: R-CACSScS

R-CACSScS

Finds a channel between a client and a service, where authentication on this channel is controlled by authentication on another channel from the same client to a second service, along with the hosts of the client and the second service.

(empty)

CC.AuC.CACSScS.1

Possible access to Process by compromised or impersonated client Client of Service: if service Process redirects clients to service Service for authentication, an attacker able to access Service as Client will be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.1

Possible access to Process as client Client by false client of compromised service Service: if service Process redirects clients to service Service for authentication, and Service is compromised, then attackers may be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.2

Possible access to Process as client Client by interception of credentials by a service imposter: if service Process redirects clients to service Service for authentication, an attacker able to impersonate service Service to Client. Since the attacker would then have access to credentials (even if limited to a single use), they can impersonate Client to Process. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.3

Possible access to Process as client Client by snooping credentials between Client and authenticator Service: if service Process redirects clients to service Service for authentication, an attacker able to snoop the token issued by Service may be able to impersonate Client to Process before Client does the same, even if the credential is limited to a single use. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuS.CACSScS.3.1

Service Process spoofed to client Client by false redirection from Service: service Process authenticates clients by redirecting via authenticator Process. However, if Process is compromised, it may redirect clients back to the wrong service.

CC.AX.CACSScS.0

Client Client unable to authenticate with Service to access service Process: the service Process requires that clients authenticate with a separate service Service, which is inaccessible to client Client.