CAPEC-267: Leverage Alternate Encoding
Description
An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate Data Structures
Prerequisites
- The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.
Skills required
- LowAn adversary can inject different representation of a filtered character in a different encoding.
- MediumAn adversary may craft subtle encoding of input data by using the knowledge that they have gathered about the target host.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- Authorization
Execute Unauthorized Commands
Run Arbitrary Code
- AccountabilityAuthenticationAuthorizationNon-Repudiation
Gain Privileges
- Access ControlAuthorization
Bypass Protection Mechanism
- Availability
Unreliable Execution; Resource Consumption
Denial of Service
Mitigations
- Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)
- Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-73External Control of File Name or Path
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-172Encoding Error
- CWE-173Improper Handling of Alternate Encoding
- CWE-180Incorrect Behavior Order: Validate Before Canonicalize
- CWE-181Incorrect Behavior Order: Validate Before Filter
- CWE-692Incomplete Denylist to Cross-Site Scripting
- CWE-697Incorrect Comparison
ATT&CK techniques (CAPEC taxonomy mapping)
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared
Related attack patterns
Parent
More specific patterns
- CAPEC-3Using Leading 'Ghost' Character Sequences to Bypass Input FiltersDetailed
- CAPEC-4Using Alternative IP Address EncodingsDetailed
- CAPEC-43Exploiting Multiple Input Interpretation LayersDetailed
- CAPEC-52Embedding NULL BytesDetailed
- CAPEC-53Postfix, Null Terminate, and BackslashDetailed
- CAPEC-64Using Slashes and URL Encoding Combined to Bypass Validation LogicDetailed
- CAPEC-71Using Unicode Encoding to Bypass Validation LogicDetailed
- CAPEC-72URL EncodingDetailed
- CAPEC-78Using Escaped Slashes in Alternate EncodingDetailed
- CAPEC-79Using Slashes in Alternate EncodingDetailed
- CAPEC-80Using UTF-8 Encoding to Bypass Validation LogicDetailed
- CAPEC-120Double EncodingDetailed