CAPEC-121: Exploit Non-Production Interfaces
Description
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The target must have configured non-production interfaces and failed to secure or remove them when brought into a production environment.
Skills required
- HighExploiting non-production interfaces requires significant skill and knowledge about the potential non-production interfaces left enabled in production.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges; Bypass Protection Mechanism
- ConfidentialityAccess ControlAuthorization
Read Data; Execute Unauthorized Commands
- Access ControlIntegrity
Modify Data; Alter Execution Logic
Mitigations
- Ensure that production systems do not contain non-production interfaces and that these interfaces are only used in development environments.
Related weaknesses (CWE)
- CWE-489Active Debug Code
- CWE-1209Failure to Disable Reserved Bits
- CWE-1259Improper Restriction of Security Token Assignment
- CWE-1267Policy Uses Obsolete Encoding
- CWE-1270Generation of Incorrect Security Tokens
- CWE-1294Insecure Security Identifier Mechanism
- CWE-1295Debug Messages Revealing Unnecessary Information
- CWE-1296Incorrect Chaining or Granularity of Debug Components
- CWE-1302Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
- CWE-1313Hardware Allows Activation of Test or Debug Logic at Runtime