CAPECattack pattern

CAPEC-635 Alternative Execution Due to Deceptive Filenames

High Official page ↗
Abstraction
Standard
Status
Draft
Typical severity
High
CAPEC version
3.9

Description

The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Prerequisites

• The use of the file must be controlled by the file extension.

Mitigations

• Applications should insure that the content of the file is consistent with format it is expecting, and not depend solely on the file extension.

Related

Att&ck technique · MITRE ATT&CK (1)

  • T1036.007 Double File Extension sub-technique

Child of · CAPEC (1)

Weakness · CWE (1)

  • CWE-162 Improper Neutralization of Trailing Special Elements weakness

Referenced by CAPEC · child of (2)

  • CAPEC-11 Cause Web Server Misclassification attack pattern
  • CAPEC-649 Adding a Space to a File Extension attack pattern

Referenced by CWE · attack pattern (1)

  • CWE-162 Improper Neutralization of Trailing Special Elements weakness