CAPEC-52: Embedding NULL Bytes
Description
An adversary embeds one or more null bytes in input to the target software. This attack relies on the usage of a null-valued byte as a string terminator in many environments. The goal is for certain components of the target software to stop processing the input when it encounters the null byte(s).
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate Data Structures
Prerequisites
- The program does not properly handle postfix NULL terminators
Skills required
- MediumDirectory traversal
- HighExecution of arbitrary code
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
Mitigations
- Properly handle the NULL characters supplied as part of user input prior to doing anything with the data.
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-158Improper Neutralization of Null Byte or NUL Character
- CWE-172Encoding Error
- CWE-173Improper Handling of Alternate Encoding
- CWE-697Incorrect Comparison
- CWE-707Improper Neutralization