COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-251

Local Code Inclusion

The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

Abstraction

Standard

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

Requirements

What does the attack require?

Prerequisites

  • The targeted application must have a bug that allows an adversary to control which code file is loaded at some juncture.
  • Some variants of this attack may require that old versions of some code files be present and in predictable locations.

Skills required

Not stated in the MITRE record.

Resources required

  • The adversary needs to have enough access to the target application to control the identity of a locally included file. The attacker may also need to be able to upload arbitrary code files to the target machine, although any location for these files may be acceptable.

Impact

What does a successful attack lead to?

Execute Unauthorized Commands

Affected scopes: Integrity

Read Data

Affected scopes: Confidentiality

Defence

How is it prevented and mitigated?

1
Implementation: Avoid passing user input to filesystem or framework API. If necessary to do so, implement a specific, allowlist approach.
CAPEC-251: Local Code Inclusion — DayBreach Saldırı Sözlüğü · DayBreach