CAPEC-152: Injection (Injecting Control Plane content through the Data Plane)
Injection (Injecting Control Plane content through the Data Plane)
Category ID: 152
Status: Draft
Description
Summary
An attacker is able to control or disrupt the behavior of an
target through crafted input data submitted using an interface functioning to
process data input. This happens when the attacker adds material to their input
that is interpreted by the application causing the targeted application to
perform steps unintended by the application manager or causing the application
to enter an unstable state. This attack differs from Data Structure Attacks in
that the latter attacks subvert the underlying structures that hold
user-provided data, either pre-empting interpretation of the input (in the case
of Buffer Overflows) or resulting in values that the targeted application is
unable to handle correctly (in the case of Integer Overflows). In Injection
attacks, the input is interpreted by the application, but the attacker has
included instructions to the interpreting functions that the target application
then follows.
Attack Prerequisites
The target application must accept input from the user. In virtually all
cases, this must be string input.
The attacker must fail to adequately filter the user input against the
insertion of instructions to the input interpreter.
Resources Required
No special resources are required for most variants of this attack.
Vision and Technical Leadership provided by Cigital, Inc.
This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.