CAPEC-649
Adding a Space to a File Extension
2018-05-31
00h00 +00:00
00h00 +00:00
Peringatan untuk CAPEC tertentu
Tetap terinformasi tentang perubahan untuk CAPEC tertentu.
Deskripsi CAPEC
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
Informasi CAPEC
Prasyarat
The use of the file must be controlled by the file extension.Mitigasi
File extensions should be checked to see if non-visible characters are being included.Kelemahan Terkait
| Nama Kelemahan | |
|---|---|
CWE-46 |
Path Equivalence: 'filename ' (Trailing Space) The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files. |
Pengajuan
| Nama | Organisasi | Tanggal | Tanggal rilis |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modifikasi
| Nama | Organisasi | Tanggal | Komentar |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
