COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-635

Alternative Execution Due to Deceptive Filenames

The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Requirements

What does the attack require?

Prerequisites

  • The use of the file must be controlled by the file extension.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Defence

How is it prevented and mitigated?

1
Applications should insure that the content of the file is consistent with format it is expecting, and not depend solely on the file extension.