CAPEC-267: Leverage Alternate Encoding

Standard Draft 严重程度: High 攻击可能性: High

CAPEC版本: 3.9

更新日期: 2023-01-24

攻击模式描述

An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.

执行流程

步骤 1 Explore

[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.

技术:
  • Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
  • Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
  • Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
  • Manually inspect the application to find entry points.
步骤 2 Experiment

[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.

技术:
  • Try to use different encodings of content in order to bypass validation routines.

前提条件

  • The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.

所需技能

Low An adversary can inject different representation of a filtered character in a different encoding.
Medium An adversary may craft subtle encoding of input data by using the knowledge that they have gathered about the target host.

后果影响

影响范围: Integrity

技术影响: Modify Data

影响范围: Confidentiality

技术影响: Read Data

影响范围: Authorization

技术影响: Execute Unauthorized Commands

说明: Run Arbitrary Code

影响范围: Accountability Authentication Authorization Non-Repudiation

技术影响: Gain Privileges

影响范围: Access Control Authorization

技术影响: Bypass Protection Mechanism

影响范围: Availability

技术影响: Unreliable Execution

说明: Denial of Service

缓解措施

Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)

Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.

示例实例

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote adversaries to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability." Related Vulnerabilities CVE-2010-0488

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

分类映射

分类名称 条目ID 条目名称
ATTACK 1027 Obfuscated Files or Information
关键信息

CAPEC ID: CAPEC-267

抽象级别: Standard

状态: Draft

典型严重程度: High

攻击可能性: High

相关攻击模式