Matching CCCSDF-VCCS-i

URI: MP-CCCSDF-VCCS-i

Package: ProcessComms

< prev | next >

Description: Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service, plus a data flow and any data fields not encrypted with keys from a vault flowing to the second service from the first but not from the client.

Root Pattern: R-CCCSDFCCS

R-CCCSDFCCS

Finds a client accessing a service that uses another service, via the associated client channels, plus a data flow to the second service from the first.

Threat Patterns (1)

DF.Auth.CCCSDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Service: if client Client does not send data Data to its service Service, it is still possible to inject false content into the data flow via service Service using a confused deputy attack. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).