CAPEC-240 Resource Injection

An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.

• The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g., overwrite the file)

• Confidentiality: Read Data • Integrity: Modify Data

• Ensure all input content that is delivered to client is sanitized against an acceptable content specification. • Perform input validation for all content. • Enforce regular patching of software.