COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-267

Leverage Alternate Encoding

An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.

Soyutlama

Standard

Tipik ciddiyet

High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Survey the application for user-controllable inputs

Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.

Kullanılan teknikler

  • Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
  • Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
  • Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
  • Manually inspect the application to find entry points.
2

Experiment

Probe entry points to locate vulnerabilities

The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.

Kullanılan teknikler

  • Try to use different encodings of content in order to bypass validation routines.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.

Gerekli beceri

  • Low: An adversary can inject different representation of a filtered character in a different encoding.
  • Medium: An adversary may craft subtle encoding of input data by using the knowledge that they have gathered about the target host.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Modify Data

Etkilenen alanlar: Integrity

Read Data

Etkilenen alanlar: Confidentiality

Execute Unauthorized Commands

Etkilenen alanlar: Authorization

Gain Privileges

Etkilenen alanlar: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Etkilenen alanlar: Access Control, Authorization

Unreliable ExecutionResource Consumption

Etkilenen alanlar: Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)
2
Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote adversaries to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability." Related Vulnerabilities CVE-2010-0488
Örnek olay 2Detay
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.