CAPEC-13: Subverting Environment Variable Values
Description
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- An environment variable is accessible to the user.
- An environment variable used by the application can be tainted with user supplied data.
- Input data used in an environment variable is not validated properly.
- The variables encapsulation is not done properly. For instance setting a variable as public in a class makes it visible and an adversary may attempt to manipulate that variable.
Skills required
- LowIn a web based scenario, the client controls the data that it submitted to the server. So anybody can try to send malicious data and try to bypass the authentication mechanism.
- HighSome more advanced attacks may require knowledge about protocols and probing technique which help controlling a variable. The malicious user may try to understand the authentication mechanism in order to defeat it.
Consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism
- Availability
Unreliable Execution
- Confidentiality
Read Data
- Accountability
Hide Activities
Mitigations
- Protect environment variables against unauthorized read and write access.
- Protect the configuration files which contain environment variables against illegitimate read and write access.
- Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system.
- Apply the least privilege principles. If a process has no legitimate reason to read an environment variable do not give that privilege.
Related weaknesses (CWE)
- CWE-15External Control of System or Configuration Setting
- CWE-20Improper Input Validation
- CWE-73External Control of File Name or Path
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285Improper Authorization
- CWE-302Authentication Bypass by Assumed-Immutable Data
- CWE-353Missing Support for Integrity Check
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SICASystem Init Config Analysis2 shared
- D3-DADynamic Analysis2 shared
- D3-EFAEmulated File Analysis2 shared
- D3-CIConfiguration Inventory2 shared
- D3-RCRestore Configuration2 shared
- D3-EALExecutable Allowlisting2 shared
- D3-EDLExecutable Denylisting2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared