CAPECattack pattern
CAPEC-649 Adding a Space to a File Extension
Medium
Official page ↗
- Abstraction
- Detailed
- Status
- Draft
- Likelihood of attack
- Low
- Typical severity
- Medium
- CAPEC version
- 3.9
Description
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
Prerequisites
• The use of the file must be controlled by the file extension.
Consequences
• Confidentiality, Integrity, Availability: Execute Unauthorized Commands
Mitigations
• File extensions should be checked to see if non-visible characters are being included.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1036.006 Space after Filename sub-technique
Child of · CAPEC (1)
- CAPEC-635 Alternative Execution Due to Deceptive Filenames attack pattern
Weakness · CWE (1)
- CWE-46 Path Equivalence: 'filename ' (Trailing Space) weakness
Referenced by CWE · attack pattern (1)
- CWE-46 Path Equivalence: 'filename ' (Trailing Space) weakness