Matching DFsXSS

URI: MP-DFsXSS

Description: Finds a human using a web browser that accesses a service running on a Host and using inflowing data, along with optional host and service managers. The data flow destination is matched twice so it can be referred to in CSGs using different role names.

Root Pattern: R-DFsXSS

R-DFsXSS

Finds a human using a web browser that accesses a service running on a Host and using inflowing data. The data flow destination is matched twice so it can be referred to in CSGs using different role names.

(empty)

CC.AuC.DFsXSS.3

Stored XSS exploit against Client by Service injected via input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Service from FlowsFrom can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.

Matching DFsXSS

R-DFsXSS

Construction Patterns (0)

Threat Patterns (1)

CC.AuC.DFsXSS.3