COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-253

Remote Code Inclusion

The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.

Soyutlama

Standard

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Target application server must allow remote files to be included.The malicious file must be placed on the remote machine previously.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Minimize attacks by input validation and sanitization of any user data that will be used by the target application to locate a remote file to be included.
CAPEC-253: Remote Code Inclusion — DayBreach Saldırı Sözlüğü · DayBreach