An attacker utilizes discovered or crafted file path information for the
purpose of locating and exploiting a security sensitive resource. This
category of attack involves the paths used by an application to store or
retrieve resources. Specifically, attacks in this category involve
manipulating the path, causing the application to look in location
unintended by the application maintainer, or determining the paths through
prediction or lookup. This differs from File Manipulation attacks in which
the contents of the files are affected or where the files themselves are
physically moved. Instead, this attack simply concerns itself with the paths
used to find or create resources.
Attack Prerequisites
None. All applications rely on file paths and so, in theory, they or their
resources could be affected by this attack.
Resources Required
No special resources are required for most variants of this attack.
Vision and Technical Leadership provided by Cigital, Inc.
This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.