Which attack involves duplicating the SOAP message body during TLS translation to impersonate a legitimate user?

Which attack involves duplicating the SOAP message body during TLS translation to impersonate a legitimate user?

• A. MITC
• B. Wrapping Attack
• C. Side Channel Attack
• D. Cloud Hopper Attack

Answer: (B)

This question tests a SOAP message security vulnerability known as a wrapping attack. In WS-Security for SOAP, the message is signed to guarantee integrity and authenticity of the body. An attacker can duplicate the SOAP body and place it inside a new wrapper so that the signature still validates against the original structure, while the application ends up processing the attacker’s modified inner body. The transport layer (TLS) only protects the channel; it doesn’t fix how the SOAP message is parsed and validated at the application layer. Because the service ends up acting on content that appears signed and from a legitimate user, the attacker can impersonate that user and perform actions they shouldn’t be able to. This is distinct from other listed attack types, which don’t involve manipulating the SOAP body within WS-Security to impersonate a user.

This question tests a SOAP message security vulnerability known as a wrapping attack. In WS-Security for SOAP, the message is signed to guarantee integrity and authenticity of the body. An attacker can duplicate the SOAP body and place it inside a new wrapper so that the signature still validates against the original structure, while the application ends up processing the attacker’s modified inner body. The transport layer (TLS) only protects the channel; it doesn’t fix how the SOAP message is parsed and validated at the application layer. Because the service ends up acting on content that appears signed and from a legitimate user, the attacker can impersonate that user and perform actions they shouldn’t be able to. This is distinct from other listed attack types, which don’t involve manipulating the SOAP body within WS-Security to impersonate a user.