CAPEC-649: Adding a Space to a File Extension
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
Last updated
Overview
CAPEC-649 (Adding a Space to a File Extension) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
What the attacker needs
Prerequisites
- The use of the file must be controlled by the file extension.
Consequences
What a successful CAPEC-649 attack can achieve.
Execute Unauthorized Commands
Affects: Confidentiality, Integrity, Availability
How to mitigate it
Defenses that reduce the risk of CAPEC-649.
- File extensions should be checked to see if non-visible characters are being included.
Terminology & mappings
Mapped taxonomies
- ATTACK: Masquerading:Space after Filename (1036.006)
Frequently asked questions
Common questions about CAPEC-649.
- What is CAPEC-649?
- An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
- How do you prevent CAPEC-649?
- File extensions should be checked to see if non-visible characters are being included.
- What weaknesses does CAPEC-649 target?
- CAPEC-649 exploits 1 CWE weakness, including CWE-46 (Path Equivalence: 'filename ' (Trailing Space)).
- How severe is CAPEC-649?
- MITRE rates CAPEC-649 as Medium severity with low likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-649
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.