Ace of Tampering II
You’ve invented a new tampering attack:
|
Threat |
|
|
|
An attacker adds additional fields to a payload being passed to an API call. You process all key-value pairs and your default behavior doesn’t validate the input. |
|
CAPEC |
CAPEC-36: Using Unpublished Interfaces or Functionality CAPEC-138: Reflection Injection |
|
ASVS |
5.1.1: Ensure parameter pollution safeguards are in place 5.1.2: Ensure only allowed fields are retrieved from the payload 5.1.3: Validate all untrusted data and use allow lists where possible |
|
CWE |
CAPEC-235: Improper Handling of Extra Parameters CAPEC-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes |
...
