COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-240

Resource Injection

An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.

Abstraction

Meta

Typical severity

High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.

Requirements

What does the attack require?

Prerequisites

  • The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g., overwrite the file)

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Modify Data

Affected scopes: Integrity

Defence

How is it prevented and mitigated?

1
Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
2
Perform input validation for all content.
3
Enforce regular patching of software.
CAPEC-240: Resource Injection — DayBreach Saldırı Sözlüğü · DayBreach