CAPEC-650: Upload a Web Shell to a Web Server
Description
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a gateway to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- The web server is susceptible to one of the various web application exploits that allows for uploading a shell file.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Mitigations
- Make sure your web server is up-to-date with all patches to protect against known vulnerabilities.
- Ensure that the file permissions in directories on the web server from which files can be execute is set to the least privilege settings, and that those directories contents is controlled by an allowlist.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CSCredential Scrubbing1 shared
- D3-DLVDomain Logic Validation1 shared
- D3-TLTrusted Library1 shared
- D3-VIVariable Initialization1 shared
- D3-RNARestore Network Access1 shared
- D3-EREmail Removal1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
- D3-NNINetwork Node Inventory1 shared
- D3-PLMPhysical Link Mapping1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-ABPIApplication-based Process Isolation1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.