CAPEC-76 Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

1. [Explore] [Fingerprinting of the operating system] In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used. 2. [Explore] [Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user 3. [Experiment] [Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of the targeted file or other file system control syntax to be passed to the application 4. [Exploit] [Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)

• Program must allow for user controlled variables to be applied directly to the filesystem

• [Low] To identify file system entry point and execute against an over-privileged system interface

• Confidentiality, Access Control, Authorization: Gain Privileges • Integrity: Modify Data

• Design: Enforce principle of least privilege. • Design: Ensure all input is validated, and does not contain file system commands • Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. • Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication. • Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.