CAPEC-251: Local Code Inclusion
Description
The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Inject Unexpected Items
Prerequisites
- The targeted application must have a bug that allows an adversary to control which code file is loaded at some juncture.
- Some variants of this attack may require that old versions of some code files be present and in predictable locations.
Consequences
- Integrity
Execute Unauthorized Commands
Through local code inclusion, the adversary compromises the integrity of the application.
- Confidentiality
Read Data
An attacker may leverage local code inclusion in order to print sensitive data to a page, such as hidden configuration files or or password hashes.
Mitigations
- Implementation: Avoid passing user input to filesystem or framework API. If necessary to do so, implement a specific, allowlist approach.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-MBTMemory Boundary Tracking1 shared
- D3-PCSVProcess Code Segment Verification1 shared
- D3-SFASystem File Analysis1 shared
- D3-PSEPProcess Segment Execution Prevention1 shared
- D3-SAORSegment Address Offset Randomization1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-HBPIHardware-based Process Isolation1 shared
- D3-PSAProcess Spawn Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.