Home > CAPEC List > CAPEC-6: Argument Injection (Version 3.0)  

CAPEC-6: Argument Injection

Attack Pattern ID: 6
Abstraction: Standard
Status: Draft
Presentation Filter:
+ Description
An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
+ Likelihood Of Attack

High

+ Typical Severity

High

+ Relationships

The table(s) below shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.

+ Relevant to the view "Mechanisms of Attack" (CAPEC-1000)
NatureTypeIDName
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.137Parameter Injection
+ Execution Flow
Explore
  1. Discovery of potential injection vectors: Using an automated tool or manual discovery, the attacker identifies services or methods with arguments that could potentially be used as injection vectors (OS, API, SQL procedures, etc.). Manually cover the application and record the possible places where arguments could be passed into external systems. Use a spider, for web applications, to create a list of URLs and associated inputs.

    Techniques
    Manually cover the application and record the possible places where arguments could be passed into external systems.
    Use a spider, for web applications, to create a list of URLs and associated inputs.
Experiment
  1. 1. Attempt variations on argument content: Possibly using an automated tool, the attacker will perform injection variations of the arguments. Use a very large list of probe strings in order to detect if there is a positive result, and, what type of system has been targeted (if obscure). Use a proxy tool to record results, error messages and/or log if accessible.

    Techniques
    Use a very large list of probe strings in order to detect if there is a positive result, and, what type of system has been targeted (if obscure).
    Use a proxy tool to record results, error messages and/or log if accessible.
Exploit
  1. Abuse of the application: The attacker injects specific syntax into a particular argument in order to generate a specific malicious effect in the targeted application. Manually inject specific payload into targeted argument.

    Techniques
    Manually inject specific payload into targeted argument.
+ Prerequisites
Target software fails to strip all user-supplied input of any content that could cause the shell to perform unexpected actions.
Software must allow for unvalidated or unfiltered input to be executed on operating system shell, and, optionally, the system configuration must allow for output to be sent back to client.
+ Skills Required
[Level: Medium]
The attacker has to identify injection vector, identify the operating system-specific commands, and optionally collect the output.
+ Resources Required
Ability to communicate synchronously or asynchronously with server. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.
+ Consequences

The table below specifies different individual consequences associated with the attack pattern. The Scope identifies the security property that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in their attack. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a pattern will be used to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Confidentiality
Access Control
Authorization
Gain Privileges
Integrity
Modify Data
Confidentiality
Read Data
+ Mitigations
Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific types and values, stripping or filtering out all unauthorized commands and characters in the process.
Design: Limit program privileges, so if metacharacters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chroot jails create a sandbox for the application to execute in, making it more difficult for an attacker to elevate privilege even in the case that a compromise has occurred.
Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.
+ Example Instances
A recent example instance of argument injection occurred against Java Web Start technology, which eases the client side deployment for Java programs. The JNLP files that are used to describe the properties for the program. The client side Java runtime used the arguments in the property setting to define execution parameters, but if the attacker appends commands to an otherwise legitimate property file, then these commands are sent to the client command shell. [R.6.2]
+ References
[REF-1] G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. 2004-02.
[REF-482] Jouko Pynnonen. "Java Web Start argument injection vulnerability". <http://www.securityfocus.com/archive/1/393696>.
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23CAPEC Content TeamThe MITRE Corporation

More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2018