An attack of this type exploits a system's configuration that allows an
attacker to either directly access an executable file, for example through
shell access; or in a possible worst case allows an attacker to upload a
file and then execute it. Web servers, ftp servers, and message oriented
middleware systems which have many integration points are particularly
vulnerable, because both the programmers and the administrators must be in
synch regarding the interfaces and the correct privileges for each
interface.
Attack Prerequisites
System's configuration must allow an attacker to directly access
executable files or upload files to execute. This means that any access
control system that is supposed to mediate communications between the
subkect and the object is set incorrectly or assumes a benign
environment.
Typical Likelihood of Exploit
Likelihood: High
Methods of Attack
Modification of Resources
API Abuse
Examples-Instances
Description
Consider a directory on a web server with the following
permissions
drwxrwxrwx 5 admin public 170 Nov 17 01:08 webroot
This could allow an attacker to both execute and upload and execute
programs' on the web server. This one vulnerability can be exploited by
a threat to probe the system and identify additional vulnerabilities to
exploit.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
To identify and execute against an overprivileged system
interface
Resources Required
Ability to communicate synchronously or asynchronously with server that
publishes an overprivileged directory, program, or interface. Optionally,
ability to capture output directly through synchronous communication or other
method such as FTP.
Solutions and Mitigations
Design: Enforce principle of least privilege
Design: Run server interfaces with a non-root account and/or utilize
chroot jails or other configuration techniques to constrain privileges even
if attacker gains some limited access to commands.
Implementation: Perform testing such as pentesting and vulnerability
scanning to identify directories, programs, and interfaces that grant direct
access to executables.
Attack Motivation-Consequences
Run Arbitrary Code
Data Modification
Information Leakage
Privilege Escalation
Injection Vector
Payload delivered through standard communication protocols.
Payload
Command(s) executed directly on host
Activation Zone
Client machine and client network
Payload Activation Impact
Enables attacker to execute server side code with any commands that the
program owner has privileges to.
Vision and Technical Leadership provided by Cigital, Inc.
This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.
Description
