CAPECattack pattern

CAPEC-176 Configuration/Environment Manipulation

Medium Official page ↗
Abstraction
Meta
Status
Draft
Typical severity
Medium
CAPEC version
3.9

Description

An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.

Prerequisites

• The target application must consult external files or configuration controls to control its execution. All but the very simplest applications meet this requirement.

Related

Weakness · CWE (5)

  • CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection weakness
  • CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks weakness
  • CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation weakness
  • CWE-1328 Security Version Number Mutable to Older Versions weakness
  • CWE-15 External Control of System or Configuration Setting weakness

Referenced by CAPEC · child of (5)

  • CAPEC-203 Manipulate Registry Information attack pattern
  • CAPEC-271 Schema Poisoning attack pattern
  • CAPEC-536 Data Injected During Configuration attack pattern
  • CAPEC-578 Disable Security Software attack pattern
  • CAPEC-75 Manipulating Writeable Configuration Files attack pattern

Referenced by CWE · attack pattern (5)

  • CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection weakness
  • CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks weakness
  • CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation weakness
  • CWE-1328 Security Version Number Mutable to Older Versions weakness
  • CWE-15 External Control of System or Configuration Setting weakness