cve.bz

CAPEC-182

Flash Injection

Medium severityHigh likelihoodStandard pattern

An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-182: Flash Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/182.html and https://cve.bz/cve/capec/182?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Find Injection Entry Points] The attacker first takes an inventory of the entry points of the application.

      2 techniques
      • Spider the website for all available URLs that reference a Flash application.
      • List all uninitialized global variables (such as _root.*, _global.*, _level0.*) in ActionScript, registered global variables in included files, load variables to external movies.

  2. Experiment

    They probe what they found.

    1. [Determine the application's susceptibility to Flash injection] Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to use various techniques such as direct load asfunction, controlled evil page/host, Flash HTML injection, and DOM injection to determine whether the application is susceptible to Flash injection.

      4 techniques
      • Test the page using direct load asfunction, getURL,javascript:gotRoot("")///d.jpg
      • Test the page using controlled evil page/host, http://example.com/evil.swf
      • Test the page using Flash HTML injection, "'><img src='asfunction:getURL,javascript:gotRoot("")//.jpg' >
      • Test the page using DOM injection, (gotRoot(''))

  3. Exploit

    They carry out the attack.

    1. [Inject malicious content into target] Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase

Prerequisites

  • The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link.

Skills required

  • Medium skill

    The attacker needs to have knowledge of Flash, especially how to insert content the executes commands.

Resources required

  • None: No specialized resources are required to execute this type of attack. The attacker may need to be able to serve the injected Flash content.

Consequences

What a successful attack can lead to
ImpactAffectsNote
OtherConfidentialityInformation Leakage
Modify DataIntegrity
Read DataConfidentiality
Execute Unauthorized CommandsAuthorizationRun Arbitrary Code
Gain PrivilegesAccountability, Authentication, Authorization, Non-Repudiation
Bypass Protection MechanismAccess Control, Authorization

Mitigations

  • Implementation: remove sensitive information such as user name and password in the SWF file.

  • Implementation: use validation on both client and server side.

  • Implementation: remove debug information.

  • Implementation: use SSL when loading external data

  • Implementation: use crossdomain.xml file to allow the application domain to load stuff or the SWF file called by other domain.

Weaknesses it exploits

  • CWE-20 Improper Input Validation
  • CWE-184 Incomplete List of Disallowed Inputs
  • CWE-697 Incorrect Comparison

Recent CVEs with these weaknesses

  1. 9.6CVE-2026-108186

    Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

  2. 4.9CVE-2026-105427

    Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

  3. 6.7CVE-2026-105426

    Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

  4. 4.3CVE-2026-123178

    An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionalit…

  5. 6.3CVE-2026-125871

    The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…

  6. 5.5CVE-2026-125703

    A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancilla…

  7. 7.7CVE-2026-125368

    OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run fin…

  8. 5.3CVE-2026-125113

    The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdX…

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can also be
More specific patterns

Examples

In the following example, the SWF file contains

In the following example, the SWF file contains

getURL('javascript:SomeFunc("someValue")','','GET')

A request like

http://example.com/noundef.swf?a=0:0;alert('XSS')

becomes

javascript:SomeFunc("someValue")?a=0:0;alert(123)

MITRE's words, unchanged: CAPEC-182 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.