CAPEC-174

These 'FlashVars' are most often passed to the Flash file via URL arguments or from the Object or Embed tag within the embedding HTML document. If these FlashVars are not properly sanitized, an adversary may be able to embed malicious content (such as scripts) into the HTML document.

The injected parameters can also provide the adversary control over other objects within the Flash file as well as full control over the parent document's DOM model. As such, this is a form of HTTP parameter injection, but the abilities granted to the Flash document (such as access to a page's document model, including associated cookies) make this attack more flexible. Flash Parameter Injection attacks can also preface further attacks such as various forms of Cross-Site Scripting (XSS) attacks in addition to Session Hijacking attacks.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Spider] Using a browser or an automated tool, an adversary records all instances of HTML documents that have embedded Flash files. If there is an embedded Flash file, they list how to pass global parameters to the Flash file from the embedding object.

      2 techniques

      • Use an automated tool to record all instances of URLs which have embedded Flash files and list the parameters passing to the Flash file.
      • Use a browser to manually explore the website to see whether the HTML document has embedded Flash files or not and list the parameters passing to the Flash file.

2. Experiment

   They probe what they found.

   2. [Determine the application susceptibility to Flash parameter injection] Determine the application susceptibility to Flash parameter injection. For each URL identified in the Explore phase, the adversary attempts to use various techniques such as DOM based, reflected, flashvars, and persistent attacks depending on the type of parameter passed to the embedded Flash file.

      5 techniques

      • When the JavaScript 'document.location' variable is used as part of the parameter, inject '#' and the payload into the parameter in the URL.
      • When the name of the Flash file is exposed as a form or a URL parameter, the adversary injects '?' and the payload after the file name in the URL to override some global value.
      • When the arguments passed in the 'flashvars' attributes, the adversary injects '&' and payload in the URL.
      • If some of the attributes of the <object> tag are received as parameters, the 'flashvars' attribute is injected into the <object> tag without the creator of the Web page ever intending to allow arguments to be passed into the Flash file.
      • If shared objects are used to save data that is entered by the user persistent Flash parameter injection may occur, with malicious code being injected into the Flash file and executed, every time the Flash file is loaded.

3. Exploit

   They carry out the attack.

   3. [Execute Flash Parameter Injection Attack] Inject parameters into Flash file. Based on the results of the Experiment phase, the adversary crafts the underlying malicious URL containing injected Flash parameters and submits it to the web server. Once the web server receives the request, the embedding HTML document will controllable by the adversary.

      1 technique

      • Craft underlying malicious URL and send it to the web server to take control of the embedding HTML document.

Skills required

• Medium skill

  The adversary need inject values into the global parameters to the Flash file and understand the parent HTML document DOM structure. The adversary needs to be smart enough to convince the victim to click on their crafted link.

Resources required

• The adversary must convince the victim to click their crafted link.

Consequences

Mitigations

• User input must be sanitized according to context before reflected back to the user. The JavaScript function 'encodeURI' is not always sufficient for sanitizing input intended for global Flash parameters. Extreme caution should be taken when saving user input in Flash cookies. In such cases the Flash file itself will need to be fixed and recompiled, changing the name of the local shared objects (Flash cookies).

Weaknesses it exploits

• CWE-88 Improper Neutralization of Argument Delimiters in a Command

Recent CVEs with these weaknesses

1. 4.9CVE-2026-1074042026-11-10

   Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

2. 6.7CVE-2026-1056692026-11-10

   Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.

3. 6.6CVE-2026-1256722026-11-10

   A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option ins…

4. 7.5CVE-2026-636442026-11-09

   bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. Th…

5. 6.7CVE-2026-845032026-11-09

   A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is i…

6. 6.7CVE-2026-828302026-11-08

   IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.

7. 9.9CVE-2026-174102026-11-07

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.

8. 2.7CVE-2026-170622026-11-07

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied inp…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-182 Flash Injection

Can lead to

• CAPEC-63 Cross-Site Scripting (XSS)
• CAPEC-178 Cross-Site Flashing

Can also be

• CAPEC-460 HTTP Parameter Pollution (HPP)

Examples

  <object>
    <embed src="myFlash.swf" flashvars="location=http://example.com/index.htm#&globalVar=e-v-i-l"></embed>
  </object>

// Create a new shared object or read an existing one
mySharedObject = SharedObject.getLocal("flashToLoad");
if (_root.flashfile == undefined) {
// Check whether there is a shared object saved
  if (mySharedObject.data.flash == null) {
// Set a default
    value _root.flashfile = "defaultFlash.swf";

  } else {
// Read the flash file to load from the shared object
    _root.flashfile = mySharedObject.data.flash;

  }

}
// Store the flash file's name in the shared object

mySharedObject.data.flash = _root.flashfile;
// Load the flash file

getURL(_root.flashfile);

MITRE's words, unchanged: CAPEC-174 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.