CAPEC-19: Embedding Scripts within Scripts
Description
An adversary leverages the capability to execute their own script by embedding it within other scripts that the target software is likely to execute due to programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- Target software must be able to execute scripts, and also grant the adversary privilege to write/upload scripts.
Skills required
- LowTo load malicious script into open, e.g. world writable directory
- MediumExecuting remote scripts on host and collecting output
Consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Use browser technologies that do not allow client side scripting.
- Utilize strict type, character, and encoding enforcement.
- Server side developers should not proxy content via XHR or other means. If a HTTP proxy for remote content is setup on the server side, the client's browser has no way of discerning where the data is originating from.
- Ensure all content that is delivered to client is sanitized against an acceptable content specification.
- Perform input validation for all remote content.
- Perform output validation for all remote content.
- Disable scripting languages such as JavaScript in browser
- Session tokens for specific host
- Patching software. There are many attack vectors for XSS on the client side and the server side. Many vulnerabilities are fixed in service packs for browser, web servers, and plug in technologies, staying current on patch release that deal with XSS countermeasures mitigates this.
- Privileges are constrained, if a script is loaded, ensure system runs in chroot jail or other limited authority mode
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1027.009Obfuscated Files or Information: Embedded Payloads
- T1546.004Event Triggered Execution: Unix Shell Configuration Modification
- T1546.016Event Triggered Execution: Installer Packages
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis2 shared
- D3-EFAEmulated File Analysis2 shared
- D3-EALExecutable Allowlisting2 shared
- D3-EDLExecutable Denylisting2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared
- CAR-2020-09-005AppInit DLLs1 shared
- CAR-2020-11-011Registry Edit from Screensaver1 shared
- CAR-2013-01-002Autorun Differences1 shared