CAPEC-649
Adding a Space to a File Extension
2018-05-31
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
CAPEC の情報
前提条件
The use of the file must be controlled by the file extension.緩和策
File extensions should be checked to see if non-visible characters are being included.関連する弱点
| 弱点名 | |
|---|---|
CWE-46 |
Path Equivalence: 'filename ' (Trailing Space) The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files. |
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
