Misbehaviour LossOfAnonUserTW

URI: LossOfAnonUserTW

Package: ProcessComms

< prev | next >

Description: Untrustworthy users are able to send messages to a service from the direction of a specific client. This relates to any message so it includes messages sent anonymously, prior to authentication. It is not related to which users can access the service. Consequently, a high likelihood is not in itself a cause for concern, so the impact level should never be raised for this behaviour.

This misbehaviour affects the trustworthiness attribute AnonUserTW

Threats that cause this misbehaviour (2)

CC.AuA.CCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.

CC.AuA.OCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.

Threats caused by affected trustworthiness attribute (6)

CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.

CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.

CC.R.CACvsCCS.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.

CC.R.CCCS-i.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.

P.V.CCCS-iAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CCCvsCCSAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.