CAPEC-15 Command Delimiters

An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.

1. [Explore] [Assess Target Runtime Environment] In situations where the runtime environment is not implicitly known, the attacker makes connections to the target system and tries to determine the system's runtime environment. Knowing the environment is vital to choosing the correct delimiters. 2. [Explore] [Survey the Application] The attacker surveys the target application, possibly as a valid and authenticated user 3. [Experiment] [Attempt delimiters in inputs] The attacker systematically attempts variations of delimiters on known inputs, observing the application's response each time. 4. [Exploit] [Use malicious command delimiters] The attacker uses combinations of payload and carefully placed command delimiters to attack the software.

• Software's input validation or filtering must not detect and block presence of additional malicious command.

• [Medium] The attacker has to identify injection vector, identify the specific commands, and optionally collect the output, i.e. from an interactive session.

• Confidentiality, Integrity, Availability: Execute Unauthorized Commands • Confidentiality: Read Data

• Design: Perform allowlist validation against a positive specification for command length, type, and parameters. • Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account • Implementation: Perform input validation for all remote content. • Implementation: Use type conversions such as JDBC prepared statements.