CAPEC-159: Redirect Access to Libraries

Description

An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. If an adversary can redirect an application's attempts to access these libraries to other libraries that the adversary supplies, the adversary will be able to force the targeted application to execute arbitrary code. This is especially dangerous if the targeted application has enhanced privileges. Access can be redirected through a number of techniques, including the use of symbolic links, search path modification, and relative path manipulation.

Extended Description

For example, using a different character encoding might cause dangerous text to be treated as safe text. Alternatively, the attacker may use certain flags, such as file extensions, to make a target application believe that provided data should be handled using a certain interpreter when the data is not actually of the appropriate type. This can lead to bypassing protection mechanisms, forcing the target to use specific components for input processing, or otherwise causing the user's data to be handled differently than might otherwise be expected. This attack differs from Variable Manipulation in that Variable Manipulation attempts to subvert the target's processing through the value of the input while Input Data Manipulation seeks to control how the input is processed.

Severity :

Very High

Possibility :

High

Type :

Standard

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-38: Leveraging/Manipulating Configuration File Search Paths Leveraging/Manipulating Configuration File Search Paths CAPEC-132: Symlink Attack Symlink Attack CAPEC-154: Resource Location Spoofing Resource Location Spoofing CAPEC-185: Malicious Software Download Malicious Software Download CAPEC-471: Search Order Hijacking Search Order Hijacking CAPEC-641: DLL Side-Loading DLL Side-Loading

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The target must utilize external libraries and must fail to verify the integrity of these libraries before using them.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Low To modify the entries in the configuration file pointing to malicious libraries
Medium To force symlink and timing issues for redirecting access to libraries
High To reverse engineering the libraries and inject malicious code into the libraries

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

ATTACK | Hijack Execution Flow:Path Interception by Search Order Hijacking

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-706: Use of Incorrectly-Resolved Name or Reference

Visit http://capec.mitre.org/ for more details.