CAPEC-6 Argument Injection

An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.

1. [Explore] [Discovery of potential injection vectors] Using an automated tool or manual discovery, the attacker identifies services or methods with arguments that could potentially be used as injection vectors (OS, API, SQL procedures, etc.). 2. [Experiment] [1. Attempt variations on argument content] Possibly using an automated tool, the attacker will perform injection variations of the arguments. 3. [Exploit] [Abuse of the application] The attacker injects specific syntax into a particular argument in order to generate a specific malicious effect in the targeted application.

• Target software fails to strip all user-supplied input of any content that could cause the shell to perform unexpected actions. • Software must allow for unvalidated or unfiltered input to be executed on operating system shell, and, optionally, the system configuration must allow for output to be sent back to client.

• [Medium] The attacker has to identify injection vector, identify the operating system-specific commands, and optionally collect the output.

• Confidentiality, Access Control, Authorization: Gain Privileges • Integrity: Modify Data • Confidentiality: Read Data

• Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific types and values, stripping or filtering out all unauthorized commands and characters in the process. • Design: Limit program privileges, so if metacharacters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chroot jails create a sandbox for the application to execute in, making it more difficult for an attacker to elevate privilege even in the case that a compromise has occurred. • Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.