CAPEC-267: Leverage Alternate Encoding
An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.
Last updated
Overview
CAPEC-267 (Leverage Alternate Encoding) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.
- Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
- Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
- Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
- Manually inspect the application to find entry points.
- Step 2Experiment
[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various payloads using a variety of different types of encodings to determine if an entry point actually represents a vulnerability with insufficient validation logic and to characterize the extent to which the vulnerability can be exploited.
- Try to use different encodings of content in order to bypass validation routines.
What the attacker needs
Prerequisites
- The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the target host.
Skills required
- Low skill: An adversary can inject different representation of a filtered character in a different encoding.
- Medium skill: An adversary may craft subtle encoding of input data by using the knowledge that they have gathered about the target host.
Consequences
What a successful CAPEC-267 attack can achieve.
Modify Data
Affects: Integrity
Read Data
Affects: Confidentiality
Execute Unauthorized Commands
Affects: Authorization
Run Arbitrary Code
Gain Privileges
Affects: Accountability, Authentication, Authorization, Non-Repudiation
Bypass Protection Mechanism
Affects: Access Control, Authorization
Unreliable Execution, Resource Consumption
Affects: Availability
Denial of Service
How to mitigate it
Defenses that reduce the risk of CAPEC-267.
- Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)
- Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input.
Examples
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote adversaries to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability." Related Vulnerabilities CVE-2010-0488
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Terminology & mappings
Mapped taxonomies
- ATTACK: Obfuscated Files or Information (1027)
Frequently asked questions
Common questions about CAPEC-267.
- What is CAPEC-267?
- An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.
- How does a Leverage Alternate Encoding attack work?
- It typically unfolds over 2 phases. It begins with: [Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.
- How do you prevent CAPEC-267?
- Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc.)
- What weaknesses does CAPEC-267 target?
- CAPEC-267 exploits 9 CWE weaknesses, including CWE-20 (Improper Input Validation), CWE-73 (External Control of File Name or Path), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-172 (Encoding Error).
- How severe is CAPEC-267?
- MITRE rates CAPEC-267 as High severity with high likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-267
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.