CAPEC-35: Leverage Executable Code in Non-Executable Files
Description
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
- Likelihood of attack
- High
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The attacker must have the ability to modify non-executable files consumed by the target software.
Skills required
- LowTo identify and execute against an over-privileged system interface
Consequences
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- Integrity
Modify Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Design: Enforce principle of least privilege
- Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.
- Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.
- Implementation: Implement host integrity monitoring to detect any unwanted altering of configuration files.
- Implementation: Ensure that files that are not required to execute, such as configuration files, are not over-privileged, i.e. not allowed to execute.
Related weaknesses (CWE)
- CWE-59Improper Link Resolution Before File Access ('Link Following')
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-97Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
- CWE-270Privilege Context Switching Error
- CWE-272Least Privilege Violation
- CWE-282Improper Ownership Management
ATT&CK techniques (CAPEC taxonomy mapping)
- T1027.006Obfuscated Files or Information: HTML Smuggling
- T1027.009Obfuscated Files or Information: Embedded Payloads
- T1564.009Hide Artifacts: Resource Forking
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis2 shared
- D3-EFAEmulated File Analysis2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
- D3-RFAMRemote File Access Mediation2 shared
- D3-RFRestore File2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.