Detail CAPEC-242

CAPEC-242

Code Injection
2014-06-23
00h00 +00:00
Tinggi
Tinggi
Stable
2020-12-17
00h00 +00:00
CAPEC Mitre.org
Peringatan untuk CAPEC tertentu
Tetap terinformasi tentang perubahan untuk CAPEC tertentu.
Kelola notifikasi

Deskripsi CAPEC

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

Informasi CAPEC

Prasyarat

The target software does not validate user-controlled input such that the execution of a process may be altered by sending code in through legitimate data channels, using no other mechanism.

Mitigasi

Utilize strict type, character, and encoding enforcement
Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
Perform input validation for all content.
Enforce regular patching of software.

Kelemahan Terkait

CWE-ID Nama Kelemahan

CWE-94

 Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Referensi

REF-612

OWASP Web Security Testing Guide
https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11-Testing_for_Code_Injection.html

Pengajuan

Nama Organisasi Tanggal Tanggal rilis
CAPEC Content Team The MITRE Corporation 2014-06-23 +00:00

Modifikasi

Nama Organisasi Tanggal Komentar
CAPEC Content Team The MITRE Corporation 2017-05-01 +00:00 Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Weaknesses, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity
CAPEC Content Team The MITRE Corporation 2019-04-04 +00:00 Updated Related_Weaknesses
CAPEC Content Team The MITRE Corporation 2020-12-17 +00:00 Updated References, Taxonomy_Mappings
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.