COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-649

Adding a Space to a File Extension

An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.

Abstraction

Detailed

Typical severity

Medium

Likelihood of attack

Low

Understand the attack

What is this attack pattern?

An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.

Requirements

What does the attack require?

Prerequisites

  • The use of the file must be controlled by the file extension.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Execute Unauthorized Commands

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

1
File extensions should be checked to see if non-visible characters are being included.