Matching DFrXSS

URI: MP-DFrXSS

Package: ProcessComms

< prev | next >

Description: Finds human using a web browser that uses a service with a host, where the browser receives from another process (not the service) data not created by either the browser or its user , plus the client channel between the browser and the service which must go via an IP subnet, and optionally the service and service host managers.

Root Pattern: R-DFrXSS

R-DFrXSS

Finds human using a web browser that uses a service with a host, where the browser receives data from another process, plus the client channel between the browser and the service.

Threat Patterns (1)

CC.AuC.DFrXSS.3

Reflected XSS exploit on Client via Service injected via client input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Client from FlowsFrom can exploit a bug in Service to send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.