In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.

How does a Buffer Overflow via Parameter Expansion attack work?

It typically unfolds over 4 phases. It begins with: [Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perform manual memory management.

How do you prevent CAPEC-47?

Ensure that when parameter expansion happens in the code that the assumptions used to determine the resulting size of the parameter are accurate and that the new size of the parameter is visible to the whole system

What weaknesses does CAPEC-47 target?

CAPEC-47 exploits 9 CWE weaknesses, including CWE-20 (Improper Input Validation), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-118 (Incorrect Access of Indexable Resource ('Range Error')), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

How severe is CAPEC-47?

MITRE rates CAPEC-47 as High severity with medium likelihood of attack.

CAPEC-47: Buffer Overflow via Parameter Expansion

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Explore
[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perform manual memory management.
Step 2
Experiment
[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer.
- In this attack, the normal method of providing large user input does not work. The program performs bounds checking on the user input, but not the expanded user input. The adversary needs to provide input that they believe will be expanded by the program to overflow a buffer. To identify where this is possible, an adversary either needs to have knowledge of the inner workings of the program or use a disassembler and other reverse engineering tools to guide the search.
Step 3
Experiment
[Craft overflow content] The adversary crafts the input to be given to the program. If the intent is to simply cause the software to crash, the input needs only to expand to an excessive quantity of random data. If the intent is to leverage the overflow for execution of arbitrary code, the adversary will craft input that expands in a way that not only overflows the targeted buffer but does so in such a way that the overwritten return address is replaced with one of the adversaries' choosing which points to code injected by the adversary.
- Create specific files and directories on the system and then give input using path traversal shortcuts to those directories that could expand past an input buffer.
Step 4
Exploit
[Overflow the buffer] Using the injection vector, the adversary gives the crafted input to the program, overflowing the buffer.

How the attack works

CAPEC-47: Buffer Overflow via Parameter Expansion

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

Examples

Frequently asked questions

What is CAPEC-47?

How does a Buffer Overflow via Parameter Expansion attack work?

How do you prevent CAPEC-47?

What weaknesses does CAPEC-47 target?

How severe is CAPEC-47?

References

Defend against CAPEC-47

How the attack works

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

Examples

Related weaknesses

Related attack patterns

Parent

Frequently asked questions

What is CAPEC-47?

How does a Buffer Overflow via Parameter Expansion attack work?

How do you prevent CAPEC-47?

What weaknesses does CAPEC-47 target?

How severe is CAPEC-47?

References

Defend against CAPEC-47