CAPEC-176: Configuration/Environment Manipulation
Description
An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The target application must consult external files or configuration controls to control its execution. All but the very simplest applications meet this requirement.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
- CWE-15External Control of System or Configuration Setting
- CWE-1233Security-Sensitive Hardware Controls with Missing Lock Bit Protection
- CWE-1234Hardware Internal or Debug Modes Allow Override of Locks
- CWE-1304Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
- CWE-1328Security Version Number Mutable to Older Versions