CAPEC-137: Parameter Injection

Overview

CAPEC-137 (Parameter Injection) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The target application must use a parameter encoding where separators and parameter identifiers are expressed in regular text.
The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which is then processed.

Resources required

None: No specialized resources are required to execute this type of attack. The only requirement is the ability to provide string input to the target.

Consequences

What a successful CAPEC-137 attack can achieve.

Modify Data

Affects: Integrity

Successful parameter injection attacks mean a compromise to integrity of the application.

How to mitigate it

Defenses that reduce the risk of CAPEC-137.

Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise.
Treat all user input as untrusted data that must be validated before use.

The CWE weaknesses that CAPEC-137 exploits.

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

How this attack relates to others in the CAPEC hierarchy.

Child

Frequently asked questions

Common questions about CAPEC-137.

What is CAPEC-137?

An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.

How do you prevent CAPEC-137?

Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise.

What weaknesses does CAPEC-137 target?

CAPEC-137 exploits 1 CWE weakness, including CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')).

How severe is CAPEC-137?

MITRE rates CAPEC-137 as Medium severity with medium likelihood of attack.

References

MITRE CAPEC definition (CAPEC-137) (opens in a new tab)

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.